CVE-2026-7009: When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it…

PriorityP425medium5.3CVSS 3.1

AVNACLPRNUINSUCLINAN

EPSS

0.01%

2.5th percentile

When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP stapling*, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
curl	curl	8.17.0 – 8.17.0	—
curl	curl	8.18.0 – 8.18.0	—
curl	curl	8.19.0 – 8.19.0	—
haxx	curl	>= 8.17.0 < 8.20.0	8.20.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CVE-2026-7009: When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP stapling*, to verify that the server certificate is valid, it…

Affected

CVE-2026-7009: When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it…