CVE-2024-2398

Wednesday, March 27, 2024

8.6

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Summary

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.

Affected Software

Vendor	Product	Version Range	Status
curl	curl	`8.6.0 <= 8.6.0`	affected
curl	curl	`8.5.0 <= 8.5.0`	affected
curl	curl	`8.4.0 <= 8.4.0`	affected
curl	curl	`8.3.0 <= 8.3.0`	affected
curl	curl	`8.2.1 <= 8.2.1`	affected
curl	curl	`8.2.0 <= 8.2.0`	affected
curl	curl	`8.1.2 <= 8.1.2`	affected
curl	curl	`8.1.1 <= 8.1.1`	affected
curl	curl	`8.1.0 <= 8.1.0`	affected
curl	curl	`8.0.1 <= 8.0.1`	affected
curl	curl	`8.0.0 <= 8.0.0`	affected
curl	curl	`7.88.1 <= 7.88.1`	affected
curl	curl	`7.88.0 <= 7.88.0`	affected
curl	curl	`7.87.0 <= 7.87.0`	affected
curl	curl	`7.86.0 <= 7.86.0`	affected
curl	curl	`7.85.0 <= 7.85.0`	affected
curl	curl	`7.84.0 <= 7.84.0`	affected
curl	curl	`7.83.1 <= 7.83.1`	affected
curl	curl	`7.83.0 <= 7.83.0`	affected
curl	curl	`7.82.0 <= 7.82.0`	affected
curl	curl	`7.81.0 <= 7.81.0`	affected
curl	curl	`7.80.0 <= 7.80.0`	affected
curl	curl	`7.79.1 <= 7.79.1`	affected
curl	curl	`7.79.0 <= 7.79.0`	affected
curl	curl	`7.78.0 <= 7.78.0`	affected
curl	curl	`7.77.0 <= 7.77.0`	affected
curl	curl	`7.76.1 <= 7.76.1`	affected
curl	curl	`7.76.0 <= 7.76.0`	affected
curl	curl	`7.75.0 <= 7.75.0`	affected
curl	curl	`7.74.0 <= 7.74.0`	affected
curl	curl	`7.73.0 <= 7.73.0`	affected
curl	curl	`7.72.0 <= 7.72.0`	affected
curl	curl	`7.71.1 <= 7.71.1`	affected
curl	curl	`7.71.0 <= 7.71.0`	affected
curl	curl	`7.70.0 <= 7.70.0`	affected
curl	curl	`7.69.1 <= 7.69.1`	affected
curl	curl	`7.69.0 <= 7.69.0`	affected
curl	curl	`7.68.0 <= 7.68.0`	affected
curl	curl	`7.67.0 <= 7.67.0`	affected
curl	curl	`7.66.0 <= 7.66.0`	affected
curl	curl	`7.65.3 <= 7.65.3`	affected
curl	curl	`7.65.2 <= 7.65.2`	affected
curl	curl	`7.65.1 <= 7.65.1`	affected
curl	curl	`7.65.0 <= 7.65.0`	affected
curl	curl	`7.64.1 <= 7.64.1`	affected
curl	curl	`7.64.0 <= 7.64.0`	affected
curl	curl	`7.63.0 <= 7.63.0`	affected
curl	curl	`7.62.0 <= 7.62.0`	affected
curl	curl	`7.61.1 <= 7.61.1`	affected
curl	curl	`7.61.0 <= 7.61.0`	affected
curl	curl	`7.60.0 <= 7.60.0`	affected
curl	curl	`7.59.0 <= 7.59.0`	affected
curl	curl	`7.58.0 <= 7.58.0`	affected
curl	curl	`7.57.0 <= 7.57.0`	affected
curl	curl	`7.56.1 <= 7.56.1`	affected
curl	curl	`7.56.0 <= 7.56.0`	affected
curl	curl	`7.55.1 <= 7.55.1`	affected
curl	curl	`7.55.0 <= 7.55.0`	affected
curl	curl	`7.54.1 <= 7.54.1`	affected
curl	curl	`7.54.0 <= 7.54.0`	affected
curl	curl	`7.53.1 <= 7.53.1`	affected
curl	curl	`7.53.0 <= 7.53.0`	affected
curl	curl	`7.52.1 <= 7.52.1`	affected
curl	curl	`7.52.0 <= 7.52.0`	affected
curl	curl	`7.51.0 <= 7.51.0`	affected
curl	curl	`7.50.3 <= 7.50.3`	affected
curl	curl	`7.50.2 <= 7.50.2`	affected
curl	curl	`7.50.1 <= 7.50.1`	affected
curl	curl	`7.50.0 <= 7.50.0`	affected
curl	curl	`7.49.1 <= 7.49.1`	affected
curl	curl	`7.49.0 <= 7.49.0`	affected
curl	curl	`7.48.0 <= 7.48.0`	affected
curl	curl	`7.47.1 <= 7.47.1`	affected
curl	curl	`7.47.0 <= 7.47.0`	affected
curl	curl	`7.46.0 <= 7.46.0`	affected
curl	curl	`7.45.0 <= 7.45.0`	affected
curl	curl	`7.44.0 <= 7.44.0`	affected

Weaknesses

CWE-772 Missing Release of Resource after Effective Lifetime

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: none
- Automatable: yes
- Technical Impact: partial

CVE Program Container

Additional References

References

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.