title: OCSP verification bypass with TLS session reuse
description: curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to
the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
problem types: CWE-299 Improper Check for Certificate Revocation
affected:
{
vendor: curl
product: curl
versions:
version: 8.5.0, status: affected, lessThanOrEqual: 8.5.0, versionType: semver
defaultStatus: unaffected
}