Log in Start free

Vulnerability · Published Mar 27, 2024 · Assigned by curl

CVE-2024-2398HTTP/2 push headers memory-leak

High 8.6

In plain English

A high-severity security flaw in curl from curl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 36.1% (higher than 98% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)36.1%top 1.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8curl7.61.1-34.el8_10.2ALSA-2024:5654
AlmaLinux:9curl7.76.1-29.el9_4.1ALSA-2024:5529
AlmaLinux:9curl-minimal7.76.1-29.el9_4.1ALSA-2024:5529
AlmaLinux:8libcurl7.61.1-34.el8_10.2ALSA-2024:5654
AlmaLinux:9libcurl7.76.1-29.el9_4.1ALSA-2024:5529
AlmaLinux:8libcurl-devel7.61.1-34.el8_10.2ALSA-2024:5654
AlmaLinux:9libcurl-devel7.76.1-29.el9_4.1ALSA-2024:5529
AlmaLinux:8libcurl-minimal7.61.1-34.el8_10.2ALSA-2024:5654
AlmaLinux:9libcurl-minimal7.76.1-29.el9_4.1ALSA-2024:5529
Alpine:v3.20curl8.7.1-r0ALPINE-CVE-2024-2398
Alpine:v3.21curl8.7.1-r0ALPINE-CVE-2024-2398
Alpine:v3.22curl8.7.1-r0ALPINE-CVE-2024-2398
Alpine:v3.23curl8.7.1-r0ALPINE-CVE-2024-2398
Alpine:v3.24curl8.7.1-r0ALPINE-CVE-2024-2398
Debian:12curl7.88.1-10+deb12u6DEBIAN-CVE-2024-2398
Debian:13curl8.7.1-1DEBIAN-CVE-2024-2398
Debian:14curl8.7.1-1DEBIAN-CVE-2024-2398
Rocky Linux:8curl0:7.61.1-34.el8_10.2RLSA-2024:5654
Ubuntu:22.04:LTScurl7.81.0-1ubuntu1.16USN-6718-1
Ubuntu:22.04:LTScurl7.81.0-1ubuntu1.16UBUNTU-CVE-2024-2398
Ubuntu:24.04:LTScurl8.5.0-2ubuntu10.1UBUNTU-CVE-2024-2398
Ubuntu:24.04:LTScurl8.5.0-2ubuntu10.1USN-6718-3

Affected products (as reported)

VendorProductVersions
curl curl 8.6.0 – through 8.6.08.5.0 – through 8.5.08.4.0 – through 8.4.08.3.0 – through 8.3.08.2.1 – through 8.2.18.2.0 – through 8.2.08.1.2 – through 8.1.28.1.1 – through 8.1.1

References