CVE-2026-7009: 
cURL vulnerability analysis and mitigation

CVE-2026-7009 is an OCSP stapling bypass vulnerability in curl affecting versions 8.17.0 through 8.19.0 (inclusive). When curl is configured to use the Certificate Status Request TLS extension (OCSP stapling) for server certificate validation, it fails to detect OCSP problems and incorrectly treats the response as valid. The flaw is specifically triggered by the combination of an OpenSSL-based backend (including BoringSSL, AWS-LC, LibreSSL, or QuicTLS) and Apple SecTrust on Apple platforms (macOS, iOS, iPadOS, tvOS, watchOS). It was reported on April 25, 2026, and publicly disclosed on April 29, 2026, coordinated with the release of curl 8.20.0. The CVSS v3.1 base score is 5.3 (Medium) (curl Advisory, Openwall).

The root cause is classified as CWE-295 (Improper Certificate Validation). The vulnerability was introduced in curl 8.17.0 via commit eefd03c572996e5de4dec4fe295ad6f103e0eefc and exists in the interaction between curl's OpenSSL-based TLS backend and Apple's SecTrust certificate store. When OCSP stapling is enabled, curl fails to properly evaluate OCSP response errors returned through the Apple SecTrust API, causing it to accept potentially revoked or otherwise invalid server certificates without raising an error. Exploitation requires two specific preconditions: curl must be built against an OpenSSL-based backend, and it must be running on an Apple operating system using the native SecTrust certificate store. The vulnerability was reported by Carlos Carrillo and fixed by Stefan Eissing (curl Advisory, curl JSON).

Successful exploitation allows an unauthenticated network attacker to bypass OCSP stapling validation, causing curl to accept revoked or otherwise invalid server certificates. This enables man-in-the-middle (MitM) attacks against affected curl clients on Apple platforms, potentially exposing transmitted data to interception or tampering. The confidentiality impact is rated low (partial data exposure), with no direct integrity or availability impact, though MitM positioning could allow traffic manipulation. Both the curl command-line tool and libcurl-based applications are affected (curl Advisory, Feedly).

A proof-of-concept report exists on HackerOne (report #3694390), though no weaponized exploit code has been publicly released. There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.009% (0.000090), reflecting low near-term exploitation probability. Exploitation is limited to a narrow set of conditions — curl on Apple platforms using OpenSSL-based backends with OCSP stapling enabled — which significantly reduces the attack surface given that OCSP stapling is not widely used on the open web (HackerOne, Feedly).

1. Identify target: Locate a system running curl 8.17.0–8.19.0 on an Apple platform (macOS, iOS, iPadOS, tvOS, or watchOS) built with an OpenSSL-based backend (OpenSSL, BoringSSL, AWS-LC, LibreSSL, or QuicTLS) and using Apple SecTrust as the certificate store.
2. Confirm OCSP stapling usage: Verify that the target application or curl invocation uses OCSP stapling (e.g., via --cert-status flag or equivalent libcurl option CURLOPT_SSL_VERIFYSTATUS).
3. Position for MitM: Establish a network position between the curl client and the intended server (e.g., via ARP spoofing, rogue Wi-Fi access point, or DNS hijacking on a local network).
4. Present a revoked or invalid certificate: Serve a TLS certificate that would normally fail OCSP validation (e.g., a revoked certificate) along with a crafted or missing OCSP staple response.
5. Bypass validation: Due to the flaw, curl fails to detect the OCSP problem and accepts the invalid certificate as valid, completing the TLS handshake with the attacker-controlled server.
6. Intercept traffic: With the MitM position established and TLS terminated at the attacker's server, intercept, read, or modify the plaintext application data (curl Advisory, Openwall).

• Network: Unexpected TLS connections terminating at intermediate hosts rather than the intended server; TLS certificates presented to curl clients that are revoked or have anomalous OCSP status without triggering errors.
• Logs: curl or application logs showing successful TLS connections to servers with certificates that should have failed OCSP validation; absence of OCSP-related error messages when connecting to suspicious endpoints.
• Process/Configuration: curl processes invoked with --cert-status or applications using CURLOPT_SSL_VERIFYSTATUS on Apple platforms with OpenSSL-based builds (versions 8.17.0–8.19.0).
• Version Artifacts: Presence of curl or libcurl binaries in the affected version range (8.17.0–8.19.0) on macOS or other Apple OS environments (curl Advisory).

The primary remediation is to upgrade curl and libcurl to version 8.20.0 or later, which was released on April 29, 2026, and contains the fix in commit 51905671e07f087e28e57 (curl Advisory). If immediate upgrading is not possible, apply the upstream patch and rebuild curl from source. As a configuration-based workaround, avoid using OCSP stapling in combination with Apple SecTrust — either disable OCSP stapling (--no-cert-status or avoid CURLOPT_SSL_VERIFYSTATUS) or switch to a non-Apple-SecTrust certificate store. Organizations should audit deployments of curl on Apple platforms to identify affected versions and prioritize patching where OCSP stapling is enabled (Openwall).

Daniel Stenberg, curl's lead developer, announced the curl 8.20.0 release and the advisory on his blog and via the oss-security mailing list on April 29, 2026 (Daniel Stenberg Blog, Openwall). The advisory notes that OCSP stapling is not widely used on the open web, contextualizing the limited real-world exposure. Downstream projects including Puppet (Core 8.19/PDK 3.7), Unraid 7.2.7/7.3.0, and Yocto Project have issued security updates or advisories referencing this CVE. Community discussion on platforms like Bluesky and security forums was modest, consistent with the medium severity and narrow exploitation conditions.