Login Request a demo
Medium severity · published Sep 11, 2024
CVE-2024-8096
OCSP stapling bypass with GnuTLS
6.5
CVSS
0.8%
EPSS
No
On KEV
Description
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
curl · curl
8.9.1 through 8.9.1; 8.9.0 through 8.9.0; 8.8.0 through 8.8.0; 8.7.1 through 8.7.1; 8.7.0 through 8.7.0; 8.6.0 through 8.6.0; +34 more · source: vendor, NVD, CISA
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
BO
Bootstrap OS · Netapp
All versions, or not specified · source: NVD
DL
Debian Linux · Debian
11.0 · source: NVD
HF
H300s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H410s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H500s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H700s Firmware · Netapp
All versions, or not specified · source: NVD
OS
Ontap Select Deploy Administration Utility · Netapp
All versions, or not specified · source: NVD
OT
Ontap Tools · Netapp
10 · source: NVD
RR
RUGGEDCOM RST2428P · Siemens
before V3.3 · source: CISA
SX
SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family · Siemens
before V3.3 · source: CISA
In the news
VulnerabilityHigh
Siemens SINEC OS
View CSAF Summary SINEC OS before V3.3 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens SINEC OS are affected: RUGGEDCOM RST2428P (6GK6242-6PA00) vers:intdot/<3.3 (CVE-2022-48174, CVE-2023-7256, CVE-2023-39810, CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2023-42366, CVE-2024-6197, CVE-2024-6874, CVE-2024-7264, CVE-2024-8006, CVE-2024-8096, CVE-2024-9681, CVE-2024-11053, CVE-2024-12718, CVE-2024-41996, CVE-2024-47619, CVE-2024-52533, CVE-2025-0167, CVE-2025-0665, CVE-2025-0725, CVE-2025-1390, CVE-2025-3360, CVE-2025-4138, CVE-2025-4330, CVE-2025-4373, CVE-2025-4435, CVE-2025-4516, CVE-2025-4517, CVE-2025-6141, CVE-2025-9086, CVE-2025-9230, CVE-2025-9231, CVE-2025-9232, CVE-2025-10148, CVE-2025-27587, CVE-2025-32433, CVE-2025-38084, CVE-2025-38085, CVE-2025-38086, CVE-2025-38345, CVE-2025-38350, CVE-2025-38498, CVE-2025-39839, CVE-2025-39841, CVE-2025-39846, CVE-2025-39853, CVE-2025-39860, CVE-2025-39864, CVE-2025-39865, CVE-2025-59375) SCALANCE XCH328 (6GK5328-4TS01-2EC2) vers:intdot/<3.3 (CVE-2022-48174, CVE-2023-7256, CVE-2023-39810, CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2023-42366, CVE-2024-6197, CVE-2024-6874, CVE-2024-7264, CVE-2024-8006, CVE-2024-8096, CVE-2024-9681, CVE-2024-11053, CVE-2024-12718, CVE-2024-41996, CVE-2024-47619, CVE-2024-52533, CVE-2025-0167, CVE-2025-0665...
CVE-2022-48174CVE-2023-7256CVE-2023-39810
Feb 12, 2026·CISA Advisories
Affected product
CU
curl
curl
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8096
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8096
Vendor Advisory
https://curl.se/docs/CVE-2024-8096.html
Vendor Advisory
https://curl.se/docs/CVE-2024-8096.json
Exploit
https://hackerone.com/reports/2669852
Mailing List
http://www.openwall.com/lists/oss-security/2024/09/11/1
Mailing List
https://lists.debian.org/debian-lts-announce/2024/11/msg00008.html
Third Party Advisory
https://security.netapp.com/advisory/ntap-20241011-0005/
More from curl
9.8
CVE-2026-19931
Negotiate ambient user conn reuse
9.8
CVE-2026-9079
stale proxy password leak
9.8
CVE-2026-8925
SASL double-free
9.8
CVE-2026-11856
cross-origin Digest auth state leak
9.8
CVE-2026-10536
HTTP/2 stream-dependency tree UAF