CVE-2026-7009: OCSP stapling bypass with Apple SecTrust
When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP stapling*, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7009?
CVE-2026-7009 is classified as a medium severity vulnerability, indicating it poses a moderate risk to users.
How do I fix CVE-2026-7009?
To fix CVE-2026-7009, upgrade curl to version 8.20.0 or later to ensure proper OCSP stapling handling.
What does CVE-2026-7009 impact?
CVE-2026-7009 affects curl versions between 8.17.0 and 8.20.0, impacting systems relying on OCSP stapling for certificate validation.
Can CVE-2026-7009 lead to security breaches?
Yes, CVE-2026-7009 can potentially allow attackers to exploit OCSP validation failures, which may lead to security breaches.
What is OCSP stapling in relation to CVE-2026-7009?
In the context of CVE-2026-7009, OCSP stapling is a method used by curl to check the validity of certificates that is bypassed under certain conditions.