CVE-2024-8096

What it actually does

curl incorrectly accepts OCSP stapling responses reporting errors other than 'revoked' (such as 'unauthorized') as valid certificate status instead of treating them as failures.

Why it matters to the business

Systems relying on curl for secure transfers may connect to servers presenting problematic certificates, raising the chance of traffic interception or use of untrusted endpoints in automated workflows and scripts.

How an attack unfolds

An attacker hosts a server returning an OCSP stapled response with a non-revocation error status; when a curl client enables the Certificate Status Request extension, the flawed validation logic accepts the response and proceeds with the TLS handshake.

How to fix it

Upgrade curl to a build containing commit a3bd1dda12ec79cd63e0d81df4ec4b1fbbbcfa1b or later; rebuild any dependent applications against the patched library.

How to confirm the fix worked

Confirm the installed curl binary reports a version built after the referenced commit; test connectivity against a server configured to return non-revocation OCSP error statuses and verify rejection occurs.

Typical attack path

1. Attacker provisions a TLS server that supplies an OCSP staple indicating an error status other than revoked
2. Victim client invokes curl with OCSP stapling verification enabled
3. curl processes the staple and fails to flag the error condition
4. TLS session completes and subsequent data exchange occurs over the untrusted connection

How to detect it

Examine application logs for successful TLS connections initiated by curl when OCSP stapling was requested; correlate with external OCSP responder logs or packet captures showing non-revocation error statuses that were nevertheless accepted.

What your security team should do

• Prioritize updating all curl installations and dependent packages to the fixed commit
• Review scripts and applications that explicitly enable OCSP stapling and consider disabling the feature where certificate revocation checking is not mandatory
• Include curl in routine dependency scanning and patch management processes