CVE-2020-8286: Apple Mac OS X

High severity, CVSS 7.5. EPSS: 4.6% chance of exploitation in the next 30 days.

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

Affected products

• Apple Mac OS X: before 10.14.6 (fixed in 10.14.6); from 10.15, before 10.15.7 (fixed in 10.15.7); version 10.14.6 only; version 10.15.7 only
• Apple macOS: from 11.0, before 11.3 (fixed in 11.3)
• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 32 only; version 33 only
• Haxx Libcurl: from 7.41.0, before 7.74.0 (fixed in 7.74.0)
• Netapp Clustered Data Ontap: affected versions not specified
• Netapp Hci Bootstrap OS: affected versions not specified
• Netapp Hci Management Node: affected versions not specified
• Netapp Hci Storage Node Firmware: affected versions not specified
• Netapp Solidfire: affected versions not specified
• Oracle Communications Billing And Revenue Management: version 12.0.0.3.0 only
• Oracle Communications Cloud Native Core Policy: version 1.14.0 only
• Oracle Essbase: version 21.2 only
• Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only
• Siemens SIMATIC Tim 1531 Irc Firmware: up to and including 2.2
• Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1)
• Splunk Universal Forwarder: from 8.2.0, before 8.2.12 (fixed in 8.2.12); from 9.0.0, before 9.0.6 (fixed in 9.0.6); version 9.1.0 only

Published 2020-12-14. Last modified 2026-06-17.