PT-2026-35897 · Curl · Curl

Carlos Carrillo + 1 · Published 2026-04-29 · Updated 2026-05-13 · CVE-2026-7009

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions curl (affected versions not specified)

Description When using the Certificate Status Request TLS extension, commonly known as OCSP stapling, to verify server certificate validity, the software fails to detect OCSP problems and incorrectly treats the response as valid.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-7009

RHSA-2026:19106

Affected Products

Curl

References · 15

• 🔥 https://hackerone.com/reports/3694390 · Exploit
• https://curl.se/docs/CVE-2026-7009.html · Vendor Advisory
• https://osv.dev/vulnerability/CURL-CVE-2026-7009 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-7009 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-7009 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7009 · Security Note
• http://openwall.com/lists/oss-security/2026/04/29/12 · Patch
• https://t.me/CVEtracker/53636 · Telegram Post
• https://curl.se/docs/CVE-2026-7009.json · Note
• https://docs.bell-sw.com/security/cves/CVE-2026-7009 · Note
• https://twitter.com/kusanagi_saya/status/2053677034485010471 · Twitter Post
• https://security.alpinelinux.org/vuln/CVE-2026-7009 · Note
• https://twitter.com/h1Disclosed/status/2050472479542616283 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2049485763729842406 · Twitter Post
• https://twitter.com/oss_security/status/2049703279857221758 · Twitter Post