{"cve":"CVE-2024-8096","nvd":{"published":"2024-09-11T10:15:02.883","modified":"2026-10-15T01:19:23.820","status":"Modified","description":"When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine.  If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5},"cwes":["CWE-295"],"references":["https://curl.se/docs/CVE-2024-8096.html","https://curl.se/docs/CVE-2024-8096.json","https://hackerone.com/reports/2669852","http://www.openwall.com/lists/oss-security/2024/09/11/1","https://lists.debian.org/debian-lts-announce/2024/11/msg00008.html"],"products":["debian:debian_linux","haxx:curl","netapp:active_iq_unified_manager","netapp:bootstrap_os","netapp:h300s_firmware","netapp:h410s_firmware","netapp:h500s_firmware","netapp:h700s_firmware","netapp:ontap_select_deploy_administration_utility","netapp:ontap_tools"],"source":"nvd","synced_at":"2026-10-19T21:54:38.012257375+00:00"},"epss":{"cve":"CVE-2024-8096","score":0.00817,"percentile":0.56841,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}