CVE-2026-7009: Haxx Curl Information Disclosure Flaw

CVE-2026-7009 Overview

CVE-2026-7009 is a certificate validation flaw [CWE-295] in curl, the widely deployed command-line tool and libcurl library used for transferring data over network protocols. When curl is instructed to use the Certificate Status Request TLS extension, commonly known as OCSP stapling, to verify server certificate validity, it fails to correctly detect OCSP problems. Instead, curl treats faulty or invalid OCSP responses as valid, undermining the revocation check the user explicitly requested.

The defect affects the Online Certificate Status Protocol (OCSP) verification path inside curl's TLS handling logic. Applications relying on stapled OCSP validation for compromised or revoked certificate detection lose that assurance silently.

Critical Impact

Clients invoking --cert-status or the equivalent libcurl option accept revoked or otherwise problematic certificates as valid, eliminating a key TLS trust check without producing any error.

Affected Products

• Haxx curl (command-line utility)
• libcurl (library bindings used by downstream applications)
• Applications and operating system distributions packaging vulnerable curl builds

Discovery Timeline

• 2026-05-13 - CVE-2026-7009 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-7009

Vulnerability Analysis

The vulnerability resides in curl's handling of the Certificate Status Request TLS extension (RFC 6066), used to perform OCSP stapling. When a TLS server returns a stapled OCSP response, curl is responsible for parsing the response, validating its signature, checking its time fields, and confirming the certificate status reported within it.

In the affected versions, curl's verification routine treats problematic OCSP responses as successful. Conditions that should produce a hard verification failure are silently accepted. The end result is that a TLS handshake completes successfully even when the OCSP staple indicates a revoked certificate or contains malformed or incomplete data.

The practical consequence is the loss of stapled revocation enforcement. Users invoking curl --cert-status rely on the explicit guarantee that curl will refuse to proceed unless a valid, current, non-revoked OCSP response is presented. CVE-2026-7009 breaks that guarantee. Network-position attackers holding a revoked but otherwise valid certificate, or attackers in possession of a stolen private key after revocation, can therefore intercept connections without triggering a curl error.

Root Cause

The root cause is improper certificate validation [CWE-295] within curl's OCSP stapling verification logic. The status check returns a success condition along a path that should return failure, so error states from the OCSP response parser are not propagated to the caller. See the cURL CVE-2026-7009 Documentation for the upstream technical write-up.

Attack Vector

Exploitation requires a network-positioned adversary capable of presenting a TLS server certificate to a curl client that has explicitly enabled OCSP stapling verification. The attacker presents a certificate whose stapled OCSP response is revoked, expired, or otherwise malformed. Because curl misreports the response as fine, the connection proceeds. Confidentiality of the session is undermined to the extent the attacker controls the endpoint, but integrity and availability of the curl process itself are not impacted, which is reflected in the limited confidentiality-only impact scoring.

No verified public proof-of-concept code is referenced in the advisory. Refer to the HackerOne Report #3694390 and the Openwall OSS-Security List Post for additional technical context.

Detection Methods for CVE-2026-7009

Indicators of Compromise

• TLS sessions established by curl-based clients to hosts presenting certificates that are revoked according to issuing CA OCSP responders, despite --cert-status being enabled.
• Outbound HTTPS connections from servers, containers, or CI/CD runners using vulnerable curl/libcurl versions to unexpected or recently re-issued domains.
• Stapled OCSP responses observed in packet captures with responseStatus values other than successful (0) that did not cause the client to abort.

Detection Strategies

• Inventory installed curl and libcurl versions across endpoints, servers, and container images, and flag versions identified as vulnerable in the cURL CVE-2026-7009 Documentation.
• Inspect application and script usage of --cert-status, CURLOPT_SSL_VERIFYSTATUS, or equivalent bindings to identify code paths that depend on stapled OCSP for trust decisions.
• Compare observed certificate serials in TLS telemetry against published certificate revocation lists (CRLs) to detect connections completed despite revocation.

Monitoring Recommendations

• Centralize TLS connection logs from forward proxies and egress gateways and alert on certificates seen in client traffic that appear on CRLs.
• Track package update status for curl and libcurl on managed hosts through configuration management or vulnerability management tooling.
• Audit container base images at build time to ensure they include a patched curl release before promotion to production registries.

How to Mitigate CVE-2026-7009

Immediate Actions Required

• Upgrade curl and libcurl to the fixed release listed in the cURL CVE-2026-7009 Documentation across all operating system packages, container images, and statically linked binaries.
• Identify every application invoking --cert-status or CURLOPT_SSL_VERIFYSTATUS and treat those trust paths as unreliable until patched versions are deployed.
• Rebuild and redeploy container images and language runtimes that bundle libcurl to ensure the patched library is loaded at runtime.

Patch Information

The curl project has published a fix referenced in the cURL CVE-2026-7009 Documentation and the corresponding cURL CVE-2026-7009 JSON Data. Linux distributions and other downstream packagers are expected to ship updated curl and libcurl packages; apply vendor updates through standard patch management once available.

Workarounds

• Where stapled OCSP is a hard trust requirement, supplement curl's check with an out-of-band revocation check against the issuing CA's OCSP responder or CRL until patched binaries are deployed.
• Restrict outbound HTTPS from sensitive workloads through a TLS-terminating proxy that performs its own certificate revocation validation independently of curl.
• Pin expected certificate fingerprints for critical destinations using --pinnedpubkey or CURLOPT_PINNEDPUBLICKEY to reduce reliance on revocation signaling for those endpoints.

# Verify installed curl version and confirm patched release is in use
curl --version

# Example: pin a known-good public key as a compensating control
curl --cert-status \
     --pinnedpubkey sha256//BASE64_PUBLIC_KEY_HASH= \
     https://example.com/