CVE-2024-0853

curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling ) test failed. A subsequent transfer tothe same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.