Medium severity5.3NVD Advisory· Published May 13, 2026· Updated May 14, 2026

CVE-2026-7009

Description

When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP stapling*, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Curl/Curl2 versions
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*range: >=8.17.0,<8.20.0
- (no CPE)

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2026/04/29/12nvdMailing ListPatchThird Party Advisory
curl.se/docs/CVE-2026-7009.htmlnvdPatchVendor Advisory
hackerone.com/reports/3694390nvdExploitIssue TrackingPatch
curl.se/docs/CVE-2026-7009.jsonnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000