HackerOne Bug Bounty Disclosure: -cve-fix-incomplete-for-aws-lc-cert-status-bypass-on-sectrust-path

Report title 08: CVE-2026-7009 fix incomplete for AWS-LC: `–cert-status` bypass on SecTrust path

Report link

Date submitted 2026-09-08T06:14:53.967Z

### What Was Reported

A researcher found that curl’s `–cert-status` option could be bypassed in a very specific configuration: curl built on macOS with AWS-LC as its TLS library and Apple’s SecTrust certificate verification enabled. In this situation, curl could accept a certificate even when the server did not provide the OCSP stapling response that the option requires.

### Why This Happened

Curl checks whether the server supplied an OCSP response. Standard OpenSSL reports a missing response using a negative value, while AWS-LC reports the same condition as a zero-length response with a `NULL` pointer. Curl only checked for the negative value, so it failed to recognize AWS-LC’s representation of a missing response.

### Affected Configurations

The issue required several conditions to occur simultaneously: AWS-LC had to be used as curl’s TLS backend, Apple SecTrust support had to be enabled, `–cert-status` or `CURLOPT_SSL_VERIFYSTATUS` had to be requested, the connection had to be a fresh TLS session, and the server had to omit the OCSP staple. This was considered a narrow combination, particularly because AWS-LC with Apple SecTrust is uncommon and OCSP stapling is not widely deployed.

### Potential Security Impact

If all of these conditions were present, curl could complete a connection even though OCSP stapling had been explicitly required. This could weaken certificate-status checking and potentially allow a revoked but otherwise trusted certificate to be used without the expected stapled status response. The report noted that exploitation would generally require a certificate and private key trusted by Apple SecTrust, such as one issued by a private or enterprise certificate authority.

Curl corrected the check so that both negative and zero-length results are treated as a missing OCSP response. The updated logic also verifies that the response pointer is not `NULL`. As a result, a missing staple now causes curl to fail with `CURLE_SSL_INVALIDCERTSTATUS`, while a valid nonempty OCSP response continues to work normally.

### Final Disposition

Curl’s security team classified the report as informative rather than as a security vulnerability. The underlying bug was fixed in commit `c878bb36f838d054adc0be27a219409842bb8365`. The report was later made public under curl’s transparency policy.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.

HackerOne report summary

Programme

Submitted by Anteater

Profile

Report title 08: CVE-2026-7009 fix incomplete for AWS-LC: `–cert-status` bypass on SecTrust path

Report link

Date submitted 2026-09-08T06:14:53.967Z

### What Was Reported

A researcher found that curl’s `–cert-status` option could be bypassed in a very specific configuration: curl built on macOS with AWS-LC as its TLS library and Apple’s SecTrust certificate verification enabled. In this situation, curl could accept a certificate even when the server did not provide the OCSP stapling response that the option requires.

### Why This Happened

Curl checks whether the server supplied an OCSP response. Standard OpenSSL reports a missing response using a negative value, while AWS-LC reports the same condition as a zero-length response with a `NULL` pointer. Curl only checked for the negative value, so it failed to recognize AWS-LC’s representation of a missing response.

### Affected Configurations

The issue required several conditions to occur simultaneously: AWS-LC had to be used as curl’s TLS backend, Apple SecTrust support had to be enabled, `–cert-status` or `CURLOPT_SSL_VERIFYSTATUS` had to be requested, the connection had to be a fresh TLS session, and the server had to omit the OCSP staple. This was considered a narrow combination, particularly because AWS-LC with Apple SecTrust is uncommon and OCSP stapling is not widely deployed.

### Potential Security Impact

If all of these conditions were present, curl could complete a connection even though OCSP stapling had been explicitly required. This could weaken certificate-status checking and potentially allow a revoked but otherwise trusted certificate to be used without the expected stapled status response. The report noted that exploitation would generally require a certificate and private key trusted by Apple SecTrust, such as one issued by a private or enterprise certificate authority.

Curl corrected the check so that both negative and zero-length results are treated as a missing OCSP response. The updated logic also verifies that the response pointer is not `NULL`. As a result, a missing staple now causes curl to fail with `CURLE_SSL_INVALIDCERTSTATUS`, while a valid nonempty OCSP response continues to work normally.

### Final Disposition

Curl’s security team classified the report as informative rather than as a security vulnerability. The underlying bug was fixed in commit `c878bb36f838d054adc0be27a219409842bb8365`. The report was later made public under curl’s transparency policy.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.