CVE-2024-8096

OCSP stapling bypass with GnuTLS

Published Sep 11, 2024 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

curl

unaffected

Version	Status	Constraints
`8.9.1`	affected	≤ 8.9.1
`8.9.0`	affected	≤ 8.9.0
`8.8.0`	affected	≤ 8.8.0
`8.7.1`	affected	≤ 8.7.1
`8.7.0`	affected	≤ 8.7.0
`8.6.0`	affected	≤ 8.6.0
`8.5.0`	affected	≤ 8.5.0
`8.4.0`	affected	≤ 8.4.0
`8.3.0`	affected	≤ 8.3.0
`8.2.1`	affected	≤ 8.2.1
`8.2.0`	affected	≤ 8.2.0
`8.1.2`	affected	≤ 8.1.2
`8.1.1`	affected	≤ 8.1.1
`8.1.0`	affected	≤ 8.1.0
`8.0.1`	affected	≤ 8.0.1
`8.0.0`	affected	≤ 8.0.0
`7.88.1`	affected	≤ 7.88.1
`7.88.0`	affected	≤ 7.88.0
`7.87.0`	affected	≤ 7.87.0
`7.86.0`	affected	≤ 7.86.0
`7.85.0`	affected	≤ 7.85.0
`7.84.0`	affected	≤ 7.84.0
`7.83.1`	affected	≤ 7.83.1
`7.83.0`	affected	≤ 7.83.0
`7.82.0`	affected	≤ 7.82.0
`7.81.0`	affected	≤ 7.81.0
`7.80.0`	affected	≤ 7.80.0
`7.79.1`	affected	≤ 7.79.1
`7.79.0`	affected	≤ 7.79.0
`7.78.0`	affected	≤ 7.78.0
`7.77.0`	affected	≤ 7.77.0
`7.76.1`	affected	≤ 7.76.1
`7.76.0`	affected	≤ 7.76.0
`7.75.0`	affected	≤ 7.75.0
`7.74.0`	affected	≤ 7.74.0
`7.73.0`	affected	≤ 7.73.0
`7.72.0`	affected	≤ 7.72.0
`7.71.1`	affected	≤ 7.71.1
`7.71.0`	affected	≤ 7.71.0
`7.70.0`	affected	≤ 7.70.0
`7.69.1`	affected	≤ 7.69.1
`7.69.0`	affected	≤ 7.69.0
`7.68.0`	affected	≤ 7.68.0
`7.67.0`	affected	≤ 7.67.0
`7.66.0`	affected	≤ 7.66.0
`7.65.3`	affected	≤ 7.65.3
`7.65.2`	affected	≤ 7.65.2
`7.65.1`	affected	≤ 7.65.1
`7.65.0`	affected	≤ 7.65.0
`7.64.1`	affected	≤ 7.64.1
`7.64.0`	affected	≤ 7.64.0
`7.63.0`	affected	≤ 7.63.0
`7.62.0`	affected	≤ 7.62.0
`7.61.1`	affected	≤ 7.61.1
`7.61.0`	affected	≤ 7.61.0
`7.60.0`	affected	≤ 7.60.0
`7.59.0`	affected	≤ 7.59.0
`7.58.0`	affected	≤ 7.58.0
`7.57.0`	affected	≤ 7.57.0
`7.56.1`	affected	≤ 7.56.1
`7.56.0`	affected	≤ 7.56.0
`7.55.1`	affected	≤ 7.55.1
`7.55.0`	affected	≤ 7.55.0
`7.54.1`	affected	≤ 7.54.1
`7.54.0`	affected	≤ 7.54.0
`7.53.1`	affected	≤ 7.53.1
`7.53.0`	affected	≤ 7.53.0
`7.52.1`	affected	≤ 7.52.1
`7.52.0`	affected	≤ 7.52.0
`7.51.0`	affected	≤ 7.51.0
`7.50.3`	affected	≤ 7.50.3
`7.50.2`	affected	≤ 7.50.2
`7.50.1`	affected	≤ 7.50.1
`7.50.0`	affected	≤ 7.50.0
`7.49.1`	affected	≤ 7.49.1
`7.49.0`	affected	≤ 7.49.0
`7.48.0`	affected	≤ 7.48.0
`7.47.1`	affected	≤ 7.47.1
`7.47.0`	affected	≤ 7.47.0
`7.46.0`	affected	≤ 7.46.0
`7.45.0`	affected	≤ 7.45.0
`7.44.0`	affected	≤ 7.44.0
`7.43.0`	affected	≤ 7.43.0
`7.42.1`	affected	≤ 7.42.1
`7.42.0`	affected	≤ 7.42.0
`7.41.0`	affected	≤ 7.41.0

Configuration 1 [-]

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Configuration 3 [-]

OR	cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::
	cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:::::::*
	cpe:2.3:a:netapp:ontap_tools:10:::::vmware_vsphere::

Configuration 4 [-]

AND

cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-3951-1	curl security update
Ubuntu USN	USN-7012-1	curl vulnerability
Ubuntu USN	USN-8525-1	curl vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.817% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
http://www.openwall.com/lists/oss-security/2024/09/11/1
https://cert-portal.siemens.com/productcert/html/ssa-089022.html
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
https://curl.se/docs/CVE-2024-8096.html
https://curl.se/docs/CVE-2024-8096.json
https://hackerone.com/reports/2669852
https://lists.debian.org/debian-lts-announce/2024/11/msg00008.html
https://nvd.nist.gov/vuln/detail/CVE-2024-8096
https://security.netapp.com/advisory/ntap-20241011-0005/
https://www.cve.org/CVERecord?id=CVE-2024-8096

History

Oct 15, 2026 1:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-089022.html https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Jul 30, 2025 7:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Debian Debian debian Linux Haxx Haxx curl Netapp Netapp active Iq Unified Manager Netapp bootstrap Os Netapp h300s Netapp h300s Firmware Netapp h410s Netapp h410s Firmware Netapp h500s Netapp h500s Firmware Netapp h700s Netapp h700s Firmware Netapp hci Compute Node Netapp ontap Select Deploy Administration Utility Netapp ontap Tools
CPEs		cpe:2.3:a:haxx:curl:::::::: cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere:: cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:::::::* cpe:2.3:a:netapp:ontap_tools:10:::::vmware_vsphere:: cpe:2.3:h:netapp:h300s:-:::::::* cpe:2.3:h:netapp:h410s:-:::::::* cpe:2.3:h:netapp:h500s:-:::::::* cpe:2.3:h:netapp:h700s:-:::::::* cpe:2.3:h:netapp:hci_compute_node:-:::::::* cpe:2.3:o:debian:debian_linux:11.0:::::::* cpe:2.3:o:netapp:bootstrap_os:-:::::::* cpe:2.3:o:netapp:h300s_firmware:-:::::::* cpe:2.3:o:netapp:h410s_firmware:-:::::::* cpe:2.3:o:netapp:h500s_firmware:-:::::::* cpe:2.3:o:netapp:h700s_firmware:-:::::::*
Vendors & Products		Debian Debian debian Linux Haxx Haxx curl Netapp Netapp active Iq Unified Manager Netapp bootstrap Os Netapp h300s Netapp h300s Firmware Netapp h410s Netapp h410s Firmware Netapp h500s Netapp h500s Firmware Netapp h700s Netapp h700s Firmware Netapp hci Compute Node Netapp ontap Select Deploy Administration Utility Netapp ontap Tools

Jul 16, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00208}`	epss `{'score': 0.00169}`

Nov 22, 2024 12:00 PM Added references View changes

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2024/09/11/1 https://lists.debian.org/debian-lts-announce/2024/11/msg00008.html https://security.netapp.com/advisory/ntap-20241011-0005/

Oct 11, 2024 11:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Curl Curl curl
CPEs		cpe:2.3:a:curl:curl::::::::
Vendors & Products		Curl Curl curl
References	http://www.openwall.com/lists/oss-security/2024/09/11/1
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 11, 2024 2:30 PM Added references View changes

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2024/09/11/1

Sep 11, 2024 1:30 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-295
References		https://nvd.nist.gov/vuln/detail/CVE-2024-8096 https://www.cve.org/CVERecord?id=CVE-2024-8096
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}` threat_severity `Moderate`

Sep 11, 2024 10:15 AM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.
Title		OCSP stapling bypass with GnuTLS
References		https://curl.se/docs/CVE-2024-8096.html https://curl.se/docs/CVE-2024-8096.json https://hackerone.com/reports/2669852

Earlier changes (3)

Subscriptions

Curl Curl

Debian Debian Linux

Haxx Curl

Netapp Active Iq Unified Manager Bootstrap Os H300s H300s Firmware H410s H410s Firmware H500s H500s Firmware H700s H700s Firmware Hci Compute Node Ontap Select Deploy Administration Utility Ontap Tools

Weaknesses