CVE-2024-2398high

CVE-2024-2398: high-severity vulnerability in curl

HTTP/2 push headers memory-leak

Published · Updated

Follow this CVE+ Monitor curl+ Monitor curl

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 36%
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Affected products
curl · curl
Related CVEs — curl

In the same product, most dangerous first.

CVE-2023-38545HIGHCVE-2023-38545EPSS 78.7%CVE-2023-38039HIGHCVE-2023-38039EPSS 56.2%CVE-2019-5436HIGHCVE-2019-5436EPSS 49.7%CVE-2024-7264MEDIUMASN.1 date parser overreadEPSS 20.2%CVE-2023-38546—CVE-2023-38546EPSS 6.0%CVE-2019-5435—CVE-2019-5435EPSS 5.7%