CVE-2014-8151: Apple Mac OS X

Medium severity, CVSS 5.8. EPSS: 1.1% chance of exploitation in the next 30 days.

The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

Affected products

• Apple Mac OS X: up to and including 10.10.4
• Haxx Libcurl: version 7.31.0 only; version 7.32.0 only; version 7.33.0 only; version 7.34.0 only; version 7.35.0 only; version 7.36.0 only; …

Published 2015-01-15. Last modified 2026-06-17.