ANCHORE-2026-7009

ANCHORE-2026-7009 PUBLISHED

When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP stapling*, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine.

Affected Products

Vendor	Product	Versions
curl	curl	8.17.0

Timeline

May 13, 2026 CVE Published
May 13, 2026 CVE Updated

References

https://curl.se/docs/CVE-2026-7009.html url
https://curl.se/docs/CVE-2026-7009.json url
https://hackerone.com/reports/3694390 url

Open in Interactive Console →