Improper certificate validation in curl
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-295.
Summary
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 9 products
- .NET Core 1.0 on Red Hat Enterprise Linux
- .NET Core 1.1 on Red Hat Enterprise Linux
- .NET Core 2.0 on Red Hat Enterprise Linux
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Virtualization 3
- Red Hat JBoss Web Server 3
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2017-2629
- 2026-10-03 Alias added: GHSA-7cp4-w7q7-w394
References
More curl vulnerabilities
- TI-2023-19922 Out-of-bounds write in curl CVSS 3.1CRITICAL 9.8
- TI-2026-16162 Negotiate ambient user conn reuse CVSS 3.1CRITICAL 9.8
- TI-2026-10231 cross-origin Digest auth state leak CVSS 3.1CRITICAL 9.8
- TI-2026-09063 HTTP/2 stream-dependency tree UAF CVSS 3.1CRITICAL 9.8
- TI-2026-07976 stale proxy password leak CVSS 3.1CRITICAL 9.8
- TI-2026-07845 SASL double-free CVSS 3.1CRITICAL 9.8
Sources
- CVE-2017-2629 · CVE Program
- CVE-2017-2629 · NVD
- FIRST EPSS
- GHSA-7cp4-w7q7-w394 · GitHub Advisory Database · CC BY 4.0
- CVE-2017-2629 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences