VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 14, 2020· Updated Nov 15, 2024

CVE-2020-8286

CVE-2020-8286

Description

curl 7.41.0 through 7.73.0 fails to verify the OCSP response certificate ID when using OpenSSL, allowing a compromised server to present a fraudulent OCSP response.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

curl 7.41.0 through 7.73.0 fails to verify the OCSP response certificate ID when using OpenSSL, allowing a compromised server to present a fraudulent OCSP response.

Vulnerability

libcurl versions 7.41.0 through 7.73.0, when built with OpenSSL as the TLS backend and with OCSP stapling enabled via CURLOPT_SSL_VERIFYSTATUS (or --cert-status in the curl tool), do not verify that the OCSP response corresponds to the correct certificate. This missing check allows a fraudulent OCSP response to be accepted as valid. OCSP stapling is not enabled by default; it must be explicitly requested by the application. The vulnerability is present only when OpenSSL is the designated TLS backend [4].

Exploitation

An attacker who has compromised a TLS server or can otherwise inject a fraudulent OCSP response during the TLS handshake can supply a response that appears valid, even if the original server certificate has been revoked. No additional user interaction is required beyond the application using OCSP stapling [4].

Impact

Successful exploitation allows an attacker to bypass certificate revocation checking, enabling the use of revoked certificates. This undermines the security guarantees of TLS connections that rely on OCSP stapling. The severity is rated as Medium [4].

Mitigation

The vulnerability is fixed in libcurl version 7.74.0, released on December 9, 2020. Users should upgrade to 7.74.0 or later. Alternatively, applications can avoid relying on OCSP stapling until an upgrade is possible. The fix is implemented in commit d9d01672785b [4].

References
  1. curl - Inferior OCSP verification

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

16

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

19

News mentions

0

No linked articles in our index yet.