curl: Apple SecTrust fallback ignores CURLOPT_CRLFILE, letting a revoked cert pass

When libcurl is built with USEAPPLESECTRUST and the native Apple trust store is in use, a certificate that OpenSSL/GnuTLS rejects because it is on the operator's CURLOPTCRLFILE list is re-checked by Apple's SecTrust API instead, and SecTrust is never told about that CRL file at all. The bug...

curl: CURLOPT_PROXY_CAINFO_BLOB silently activates native CA store on Apple builds

Hi all, CURLOPTPROXYCAINFOBLOB introduced 7.77.0 never sets proxyssl.customcablob. On USEAPPLESECTRUST / CURLCANATIVE builds this causes curl to silently fall back to the system keychain for proxy TLS verification, nullifying the caller's blob-only trust policy. --- Root cause lib/setopt.c handle...

CVE-2026-7009

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine...

CVE-2026-7009 OCSP stapling bypass with Apple SecTrust

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine...

CVE-2026-7009

CVE-2026-7009 affects curl when using OCSP stapling. Providers report that curl, on Apple systems with Apple SecTrust and when built with an OpenSSL backend, fails to detect OCSP problems and treats the stapled response as valid. The Nessus entry notes a specific vulnerable range: curl 8.17.0 bef...

CVE-2026-7009 OCSP stapling bypass with Apple SecTrust

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine...

curl: CVE-2026-7009: OCSP stapling bypass with Apple SecTrust

Summary When curl is built with --with-apple-sectrust or -DUSEAPPLESECTRUST=ON and OpenSSL, the --cert-status / CURLOPTSSLVERIFYSTATUS option is silently bypassed when Apple SecTrust handles certificate chain verification instead of OpenSSL. The user explicitly requests OCSP stapling enforcement,...