CVE catalog

CVE-2024-8096

curl vulnerabilities

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.82% · Oct 25, 2026

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancurlsid8.23.0-1fixed
Debiancurlforky8.22.0-1fixed
Debiancurltrixie8.14.1-2+deb13u5fixed
Debiancurltrixie-security8.14.1-2+deb13u7fixed
Debiancurlbookworm7.88.1-10+deb12u15fixed
Debiancurlbookworm-security7.88.1-10+deb12u5vulnerable
Ubuntucurlnoble8.5.0-2ubuntu10.11fixed
Ubuntulibcurl3t64-gnutlsnoble8.5.0-2ubuntu10.11fixed
Ubuntulibcurl4-docnoble8.5.0-2ubuntu10.11fixed
Ubuntulibcurl4-gnutls-devnoble8.5.0-2ubuntu10.11fixed
Ubuntulibcurl4-openssl-devnoble8.5.0-2ubuntu10.11fixed
Ubuntulibcurl4t64noble8.5.0-2ubuntu10.11fixed
Ubuntucurlnoble7.88.1-10+deb12u8fixed
Ubuntucurlnoble8.5.0-2ubuntu10.4fixed
Ubuntulibcurl3t64-gnutlsnoble8.5.0-2ubuntu10.4fixed
Ubuntulibcurl4-docnoble8.5.0-2ubuntu10.4fixed
Ubuntulibcurl4-gnutls-devnoble8.5.0-2ubuntu10.4fixed
Ubuntulibcurl4-openssl-devnoble8.5.0-2ubuntu10.4fixed
Ubuntulibcurl4t64noble8.5.0-2ubuntu10.4fixed
CpecurlNot reported8.10.0fixed
Cpedebian_linuxNot reportedNot reportedunknown
Cpeactive_iq_unified_managerNot reportedNot reportedunknown
Cpeontap_select_deploy_administration_utilityNot reportedNot reportedunknown
Cpeontap_toolsNot reportedNot reportedunknown
Cpebootstrap_osNot reportedNot reportedunknown
Cpeh300s_firmwareNot reportedNot reportedunknown
Cpeh410s_firmwareNot reportedNot reportedunknown
Cpeh500s_firmwareNot reportedNot reportedunknown
Cpeh700s_firmwareNot reportedNot reportedunknown
Alpinecurl3.188.10.0-r0fixed
Alpinecurl3.198.10.0-r0fixed
Alpinecurl3.208.10.0-r0fixed
Alpinecurl3.218.10.0-r0fixed
Alpinecurl3.228.10.0-r0fixed
Alpinecurl3.238.10.0-r0fixed
Alpinecurl3.248.10.0-r0fixed
Ubuntucurlpro7.55.1-1ubuntu2vulnerable
Ubuntucurlpro7.55.1-1ubuntu2.1vulnerable
Ubuntucurlpro7.57.0-1ubuntu1vulnerable
Ubuntucurlpro7.58.0-2ubuntu1vulnerable
Ubuntucurlpro7.58.0-2ubuntu2vulnerable
Ubuntucurlpro7.58.0-2ubuntu3vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.1vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.2vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.3vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.5vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.6vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.7vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.8vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.9vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.10vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.12vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.13vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.14vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.15vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.16vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.17vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.18vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.19vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.20vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.21vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.22vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.23vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.24vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.24+esm1vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.24+esm2vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.24+esm3vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.24+esm4vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.24+esm5vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.24+esm7vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.24+esm8vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.24+esm9vulnerable
Ubuntucurlpro7.58.0-2ubuntu3.24+esm10fixed
Ubuntucurl20.047.65.3-1ubuntu3vulnerable
Ubuntucurl20.047.65.3-1ubuntu4vulnerable
Ubuntucurl20.047.66.0-1ubuntu1vulnerable
Ubuntucurl20.047.67.0-2ubuntu1vulnerable
Ubuntucurl20.047.68.0-1ubuntu1vulnerable
Ubuntucurl20.047.68.0-1ubuntu2vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.1vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.2vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.4vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.5vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.6vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.7vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.10vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.11vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.12vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.13vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.14vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.15vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.16vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.18vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.19vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.20vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.21vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.22vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.23vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.24fixed
Ubuntucurl22.047.74.0-1.3ubuntu2vulnerable
Ubuntucurl22.047.74.0-1.3ubuntu3vulnerable
Ubuntucurl22.047.80.0-3vulnerable
Ubuntucurl22.047.81.0-1vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.1vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.2vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.3vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.4vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.6vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.7vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.8vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.10vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.11vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.13vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.14vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.15vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.16vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.17vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.18fixed
Ubuntucurl24.048.2.1-1ubuntu3vulnerable
Ubuntucurl24.048.2.1-1ubuntu3.1vulnerable
Ubuntucurl24.048.4.0-2ubuntu1vulnerable
Ubuntucurl24.048.5.0-2ubuntu1vulnerable
Ubuntucurl24.048.5.0-2ubuntu2vulnerable
Ubuntucurl24.048.5.0-2ubuntu8vulnerable
Ubuntucurl24.048.5.0-2ubuntu9vulnerable
Ubuntucurl24.048.5.0-2ubuntu10vulnerable
Ubuntucurl24.048.5.0-2ubuntu10.1vulnerable
Ubuntucurl24.048.5.0-2ubuntu10.2vulnerable
Ubuntucurl24.048.5.0-2ubuntu10.3vulnerable
Ubuntucurl24.048.5.0-2ubuntu10.4fixed
Ubuntucurl20.047.65.3-1ubuntu3vulnerable
Ubuntucurl20.047.65.3-1ubuntu4vulnerable
Ubuntucurl20.047.66.0-1ubuntu1vulnerable
Ubuntucurl20.047.67.0-2ubuntu1vulnerable
Ubuntucurl20.047.68.0-1ubuntu1vulnerable
Ubuntucurl20.047.68.0-1ubuntu2vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.1vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.2vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.4vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.5vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.6vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.7vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.10vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.11vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.12vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.13vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.14vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.15vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.16vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.18vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.19vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.20vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.21vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.22vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.23vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.24fixed
Ubuntucurl22.047.74.0-1.3ubuntu2vulnerable
Ubuntucurl22.047.74.0-1.3ubuntu3vulnerable
Ubuntucurl22.047.80.0-3vulnerable
Ubuntucurl22.047.81.0-1vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.1vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.2vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.3vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.4vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.6vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.7vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.8vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.10vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.11vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.13vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.14vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.15vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.16vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.17vulnerable
Ubuntucurl22.047.81.0-1ubuntu1.18fixed
Ubuntucurl24.048.2.1-1ubuntu3vulnerable
Ubuntucurl24.048.2.1-1ubuntu3.1vulnerable
Ubuntucurl24.048.4.0-2ubuntu1vulnerable
Ubuntucurl24.048.5.0-2ubuntu1vulnerable
Ubuntucurl24.048.5.0-2ubuntu2vulnerable
Ubuntucurl24.048.5.0-2ubuntu8vulnerable
Ubuntucurl24.048.5.0-2ubuntu9vulnerable
Ubuntucurl24.048.5.0-2ubuntu10vulnerable
Ubuntucurl24.048.5.0-2ubuntu10.1vulnerable
Ubuntucurl24.048.5.0-2ubuntu10.2vulnerable
Ubuntucurl24.048.5.0-2ubuntu10.3vulnerable
Ubuntucurl24.048.5.0-2ubuntu10.4fixed
Opensusecurltumbleweed8.10.0-1.1fixed
Susecurllinux enterprise installer updates 15 sp58.0.1-150400.5.50.1fixed
Susecurllinux enterprise micro 5.38.0.1-150400.5.50.1fixed
Susecurllinux enterprise micro 5.48.0.1-150400.5.50.1fixed
Susecurllinux enterprise micro 5.58.0.1-150400.5.50.1fixed
Susecurllinux enterprise module for basesystem 15 sp58.0.1-150400.5.50.1fixed
Opensusecurlleap micro 5.58.0.1-150400.5.50.1fixed
Opensusecurlleap 15.58.0.1-150400.5.50.1fixed
Susecurllinux enterprise module for basesystem 15 sp68.6.0-150600.4.6.1fixed
Opensusecurlleap 15.68.6.0-150600.4.6.1fixed
Susecurllinux enterprise software development kit 12 sp58.0.1-11.92.1fixed
Susecurllinux enterprise server 12 sp58.0.1-11.92.1fixed
Susecurllinux enterprise server for sap applications 12 sp58.0.1-11.92.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancurlsourcesid8.10.0-1not yet assignedNot reportedNot reported
Debiancurlsourceforky8.10.0-1not yet assignedNot reportedNot reported
Debiancurlsourcetrixie8.10.0-1not yet assignedNot reportedNot reported
Debiancurlsourcebookworm7.88.1-10+deb12u8not yet assignedNot reportedNot reported
Ubuntucurldebnoble8.5.0-2ubuntu10.11Not reportedNot reportedNot reported
Ubuntulibcurl3t64-gnutlsdebnoble8.5.0-2ubuntu10.11Not reportedNot reportedNot reported
Ubuntulibcurl4-docdebnoble8.5.0-2ubuntu10.11Not reportedNot reportedNot reported
Ubuntulibcurl4-gnutls-devdebnoble8.5.0-2ubuntu10.11Not reportedNot reportedNot reported
Ubuntulibcurl4-openssl-devdebnoble8.5.0-2ubuntu10.11Not reportedNot reportedNot reported
Ubuntulibcurl4t64debnoble8.5.0-2ubuntu10.11Not reportedNot reportedNot reported
Ubuntucurldebnoble7.88.1-10+deb12u8Not reportedNot reportedNot reported
Ubuntucurldebnoble8.5.0-2ubuntu10.4Not reportedNot reportedNot reported
Ubuntulibcurl3t64-gnutlsdebnoble8.5.0-2ubuntu10.4Not reportedNot reportedNot reported
Ubuntulibcurl4-docdebnoble8.5.0-2ubuntu10.4Not reportedNot reportedNot reported
Ubuntulibcurl4-gnutls-devdebnoble8.5.0-2ubuntu10.4Not reportedNot reportedNot reported
Ubuntulibcurl4-openssl-devdebnoble8.5.0-2ubuntu10.4Not reportedNot reportedNot reported
Ubuntulibcurl4t64debnoble8.5.0-2ubuntu10.4Not reportedNot reportedNot reported
CpecurlcpeNot reported8.10.0Not reportedNVD-CVE-2024-8096Not reported
Alpinecurlapk3.188.10.0-r0Not reportedALPINE-CVE-2024-8096Not reported
Alpinecurlapk3.198.10.0-r0Not reportedALPINE-CVE-2024-8096Not reported
Alpinecurlapk3.208.10.0-r0Not reportedALPINE-CVE-2024-8096Not reported
Alpinecurlapk3.218.10.0-r0Not reportedALPINE-CVE-2024-8096Not reported
Alpinecurlapk3.228.10.0-r0Not reportedALPINE-CVE-2024-8096Not reported
Alpinecurlapk3.238.10.0-r0Not reportedALPINE-CVE-2024-8096Not reported
Alpinecurlapk3.248.10.0-r0Not reportedALPINE-CVE-2024-8096Not reported
Ubuntucurldebpro7.58.0-2ubuntu3.24+esm10Not reportedUBUNTU-CVE-2024-8096Not reported
Ubuntucurldeb20.047.68.0-1ubuntu2.24Not reportedUBUNTU-CVE-2024-8096Not reported
Ubuntucurldeb22.047.81.0-1ubuntu1.18Not reportedUBUNTU-CVE-2024-8096Not reported
Ubuntucurldeb24.048.5.0-2ubuntu10.4Not reportedUBUNTU-CVE-2024-8096Not reported
Ubuntucurldeb20.047.68.0-1ubuntu2.24Not reportedUSN-7012-1Not reported
Ubuntucurldeb22.047.81.0-1ubuntu1.18Not reportedUSN-7012-1Not reported
Ubuntucurldeb24.048.5.0-2ubuntu10.4Not reportedUSN-7012-1Not reported
Opensusecurlrpmtumbleweed8.10.0-1.1Not reportedOPENSUSE-SU-2024:14333-1Not reported
Susecurlrpmlinux enterprise installer updates 15 sp58.0.1-150400.5.50.1Not reportedSUSE-SU-2024:3211-1Not reported
Susecurlrpmlinux enterprise micro 5.38.0.1-150400.5.50.1Not reportedSUSE-SU-2024:3211-1Not reported
Susecurlrpmlinux enterprise micro 5.48.0.1-150400.5.50.1Not reportedSUSE-SU-2024:3211-1Not reported
Susecurlrpmlinux enterprise micro 5.58.0.1-150400.5.50.1Not reportedSUSE-SU-2024:3211-1Not reported
Susecurlrpmlinux enterprise module for basesystem 15 sp58.0.1-150400.5.50.1Not reportedSUSE-SU-2024:3211-1Not reported
Opensusecurlrpmleap micro 5.58.0.1-150400.5.50.1Not reportedSUSE-SU-2024:3211-1Not reported
Opensusecurlrpmleap 15.58.0.1-150400.5.50.1Not reportedSUSE-SU-2024:3211-1Not reported
Susecurlrpmlinux enterprise module for basesystem 15 sp68.6.0-150600.4.6.1Not reportedSUSE-SU-2024:3204-1Not reported
Opensusecurlrpmleap 15.68.6.0-150600.4.6.1Not reportedSUSE-SU-2024:3204-1Not reported
Susecurlrpmlinux enterprise software development kit 12 sp58.0.1-11.92.1Not reportedSUSE-SU-2024:3203-1Not reported
Susecurlrpmlinux enterprise server 12 sp58.0.1-11.92.1Not reportedSUSE-SU-2024:3203-1Not reported
Susecurlrpmlinux enterprise server for sap applications 12 sp58.0.1-11.92.1Not reportedSUSE-SU-2024:3203-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References