VDB
GHSA-xh5x-q49r-r9w4
GHSA-xh5x-q49r-r9w4
PUBLISHED
CVSS 7.5 HIGH
Record from GitHub Advisory Database · Published May 24, 2022
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
Risk scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Timeline
- May 24, 2022 CVE Published
- Apr 9, 2026 Security Advisory (3 in total, the first dated here)
- May 1, 2026 Distribution Patch
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-xh5x-q49r-r9w4
vulnetix vdb fixes GHSA-xh5x-q49r-r9w4Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-xh5x-q49r-r9w4/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://hackerone.com/reports/1048457 url
- https://www.oracle.com/security-alerts/cpuapr2022.html url
- https://www.oracle.com/security-alerts/cpuApr2021.html url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL url
- https://curl.se/docs/CVE-2020-8286.html url
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf url
- http://seclists.org/fulldisclosure/2021/Apr/51 url
- http://seclists.org/fulldisclosure/2021/Apr/54 url
- https://nvd.nist.gov/vuln/detail/CVE-2020-8286 advisory
- https://www.oracle.com//security-alerts/cpujul2021.html url
- https://security.netapp.com/advisory/ntap-20210122-0007 url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG url
- https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdf url
- http://seclists.org/fulldisclosure/2021/Apr/50 url
- https://www.debian.org/security/2021/dsa-4881 advisory
- https://support.apple.com/kb/HT212327 advisory
- https://support.apple.com/kb/HT212325 advisory
- https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html advisory
…and 2 more