Approved changes feed: RSS · Atom

cpe:2.3:a:haxx:curl:8.5.0:*:*:*:*:*:*:*

part: a version: 8.5.0 update: *

VendorHaxx (d671a1c6-5c93-5e0c-94d0-7f7092cb4b41)
ProductCurl (2d1ca0dd-2ad5-581e-9bc3-c802b3d3d143)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:deb/debian/curl purl2cpe 2026-06-01 10:12:19.110083
pkg:deb/ubuntu/curl purl2cpe 2026-06-01 10:12:19.110084
pkg:github/curl/curl purl2cpe 2026-06-01 10:12:19.110086
pkg:rpm/fedora/curl purl2cpe 2026-06-01 10:12:19.110087
pkg:rpm/opensuse/curl purl2cpe 2026-06-01 10:12:19.110088

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-0853 vulnerable 2026-06-08 06:22:02.990656 OCSP verification bypass with TLS session reuse
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
Published: 2024-02-03T13:35:25.863Z
Updated: 2025-06-20T20:04:09.066Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.