CVE-2024-2398
CVE-2024-2398 · HTTP/2 push headers memory-leak
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.
CVSS 8.6 · High · EPSS 36.1% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
curl
- Versions
- ≥ 8.6.0, ≤ 8.6.0: Affected (semver)
- ≥ 8.5.0, ≤ 8.5.0: Affected (semver)
- ≥ 8.4.0, ≤ 8.4.0: Affected (semver)
- ≥ 8.3.0, ≤ 8.3.0: Affected (semver)
- ≥ 8.2.1, ≤ 8.2.1: Affected (semver)
- ≥ 8.2.0, ≤ 8.2.0: Affected (semver)
- ≥ 8.1.2, ≤ 8.1.2: Affected (semver)
- ≥ 8.1.1, ≤ 8.1.1: Affected (semver)
- ≥ 8.1.0, ≤ 8.1.0: Affected (semver)
- ≥ 8.0.1, ≤ 8.0.1: Affected (semver)
- ≥ 8.0.0, ≤ 8.0.0: Affected (semver)
- ≥ 7.88.1, ≤ 7.88.1: Affected (semver)
- ≥ 7.88.0, ≤ 7.88.0: Affected (semver)
- ≥ 7.87.0, ≤ 7.87.0: Affected (semver)
- ≥ 7.86.0, ≤ 7.86.0: Affected (semver)
- ≥ 7.85.0, ≤ 7.85.0: Affected (semver)
- ≥ 7.84.0, ≤ 7.84.0: Affected (semver)
- ≥ 7.83.1, ≤ 7.83.1: Affected (semver)
- ≥ 7.83.0, ≤ 7.83.0: Affected (semver)
- ≥ 7.82.0, ≤ 7.82.0: Affected (semver)
- ≥ 7.81.0, ≤ 7.81.0: Affected (semver)
- ≥ 7.80.0, ≤ 7.80.0: Affected (semver)
- ≥ 7.79.1, ≤ 7.79.1: Affected (semver)
- ≥ 7.79.0, ≤ 7.79.0: Affected (semver)
- ≥ 7.78.0, ≤ 7.78.0: Affected (semver)
- ≥ 7.77.0, ≤ 7.77.0: Affected (semver)
- ≥ 7.76.1, ≤ 7.76.1: Affected (semver)
- ≥ 7.76.0, ≤ 7.76.0: Affected (semver)
- ≥ 7.75.0, ≤ 7.75.0: Affected (semver)
- ≥ 7.74.0, ≤ 7.74.0: Affected (semver)
- ≥ 7.73.0, ≤ 7.73.0: Affected (semver)
- ≥ 7.72.0, ≤ 7.72.0: Affected (semver)
- ≥ 7.71.1, ≤ 7.71.1: Affected (semver)
- ≥ 7.71.0, ≤ 7.71.0: Affected (semver)
- ≥ 7.70.0, ≤ 7.70.0: Affected (semver)
- ≥ 7.69.1, ≤ 7.69.1: Affected (semver)
- ≥ 7.69.0, ≤ 7.69.0: Affected (semver)
- ≥ 7.68.0, ≤ 7.68.0: Affected (semver)
- ≥ 7.67.0, ≤ 7.67.0: Affected (semver)
- ≥ 7.66.0, ≤ 7.66.0: Affected (semver)
- ≥ 7.65.3, ≤ 7.65.3: Affected (semver)
- ≥ 7.65.2, ≤ 7.65.2: Affected (semver)
- ≥ 7.65.1, ≤ 7.65.1: Affected (semver)
- ≥ 7.65.0, ≤ 7.65.0: Affected (semver)
- ≥ 7.64.1, ≤ 7.64.1: Affected (semver)
No fix published
curl Debian:12
- Versions
- 7.88.1-10
- 7.88.1-10+deb12u1
- 7.88.1-10+deb12u1~bpo11+1
- 7.88.1-10+deb12u2
- 7.88.1-10+deb12u3
- 7.88.1-10+deb12u3~bpo11+1
- 7.88.1-10+deb12u4
- 7.88.1-10+deb12u5
- 7.88.1-10+deb12u5~bpo11+1
- 7.88.1-10+deb12u6~bpo11+1
- Affected ranges
- ECOSYSTEM: < 7.88.1-10+deb12u6
Update to 7.88.1-10+deb12u6
curl Debian:13
- Affected ranges
- ECOSYSTEM: < 8.7.1-1
Update to 8.7.1-1
curl Debian:14
- Affected ranges
- ECOSYSTEM: < 8.7.1-1
Update to 8.7.1-1
curl Ubuntu:Pro:16.04:LTS
- Versions
- 7.43.0-1ubuntu2
- 7.45.0-1ubuntu1
- 7.46.0-1ubuntu1
- 7.47.0-1ubuntu1
- 7.47.0-1ubuntu2
- 7.47.0-1ubuntu2.1
- 7.47.0-1ubuntu2.2
- 7.47.0-1ubuntu2.3
- 7.47.0-1ubuntu2.4
- 7.47.0-1ubuntu2.5
- 7.47.0-1ubuntu2.6
- 7.47.0-1ubuntu2.7
- 7.47.0-1ubuntu2.8
- 7.47.0-1ubuntu2.9
- 7.47.0-1ubuntu2.11
- 7.47.0-1ubuntu2.12
- 7.47.0-1ubuntu2.13
- 7.47.0-1ubuntu2.14
- 7.47.0-1ubuntu2.15
- 7.47.0-1ubuntu2.16
- 7.47.0-1ubuntu2.18
- 7.47.0-1ubuntu2.19
- 7.47.0-1ubuntu2.19+esm1
- 7.47.0-1ubuntu2.19+esm2
- 7.47.0-1ubuntu2.19+esm3
- 7.47.0-1ubuntu2.19+esm4
- 7.47.0-1ubuntu2.19+esm5
- 7.47.0-1ubuntu2.19+esm6
- 7.47.0-1ubuntu2.19+esm7
- 7.47.0-1ubuntu2.19+esm8
- 7.47.0-1ubuntu2.19+esm9
- 7.47.0-1ubuntu2.19+esm10
- 7.47.0-1ubuntu2.19+esm11
- Affected ranges
- ECOSYSTEM: < 7.47.0-1ubuntu2.19+esm12
Update to 7.47.0-1ubuntu2.19+esm12
curl Ubuntu:Pro:18.04:LTS
- Versions
- 7.55.1-1ubuntu2
- 7.55.1-1ubuntu2.1
- 7.57.0-1ubuntu1
- 7.58.0-2ubuntu1
- 7.58.0-2ubuntu2
- 7.58.0-2ubuntu3
- 7.58.0-2ubuntu3.1
- 7.58.0-2ubuntu3.2
- 7.58.0-2ubuntu3.3
- 7.58.0-2ubuntu3.5
- 7.58.0-2ubuntu3.6
- 7.58.0-2ubuntu3.7
- 7.58.0-2ubuntu3.8
- 7.58.0-2ubuntu3.9
- 7.58.0-2ubuntu3.10
- 7.58.0-2ubuntu3.12
- 7.58.0-2ubuntu3.13
- 7.58.0-2ubuntu3.14
- 7.58.0-2ubuntu3.15
- 7.58.0-2ubuntu3.16
- 7.58.0-2ubuntu3.17
- 7.58.0-2ubuntu3.18
- 7.58.0-2ubuntu3.19
- 7.58.0-2ubuntu3.20
- 7.58.0-2ubuntu3.21
- 7.58.0-2ubuntu3.22
- 7.58.0-2ubuntu3.23
- 7.58.0-2ubuntu3.24
- 7.58.0-2ubuntu3.24+esm1
- 7.58.0-2ubuntu3.24+esm2
- 7.58.0-2ubuntu3.24+esm3
- Affected ranges
- ECOSYSTEM: < 7.58.0-2ubuntu3.24+esm4
Update to 7.58.0-2ubuntu3.24+esm4
curl Ubuntu:20.04:LTS
- Versions
- 7.65.3-1ubuntu3
- 7.65.3-1ubuntu4
- 7.66.0-1ubuntu1
- 7.67.0-2ubuntu1
- 7.68.0-1ubuntu1
- 7.68.0-1ubuntu2
- 7.68.0-1ubuntu2.1
- 7.68.0-1ubuntu2.2
- 7.68.0-1ubuntu2.4
- 7.68.0-1ubuntu2.5
- 7.68.0-1ubuntu2.6
- 7.68.0-1ubuntu2.7
- 7.68.0-1ubuntu2.10
- 7.68.0-1ubuntu2.11
- 7.68.0-1ubuntu2.12
- 7.68.0-1ubuntu2.13
- 7.68.0-1ubuntu2.14
- 7.68.0-1ubuntu2.15
- 7.68.0-1ubuntu2.16
- 7.68.0-1ubuntu2.18
- 7.68.0-1ubuntu2.19
- 7.68.0-1ubuntu2.20
- 7.68.0-1ubuntu2.21
- Affected ranges
- ECOSYSTEM: < 7.68.0-1ubuntu2.22
Update to 7.68.0-1ubuntu2.22
curl Ubuntu:22.04:LTS
- Versions
- 7.74.0-1.3ubuntu2
- 7.74.0-1.3ubuntu3
- 7.80.0-3
- 7.81.0-1
- 7.81.0-1ubuntu1.1
- 7.81.0-1ubuntu1.2
- 7.81.0-1ubuntu1.3
- 7.81.0-1ubuntu1.4
- 7.81.0-1ubuntu1.6
- 7.81.0-1ubuntu1.7
- 7.81.0-1ubuntu1.8
- 7.81.0-1ubuntu1.10
- 7.81.0-1ubuntu1.11
- 7.81.0-1ubuntu1.13
- 7.81.0-1ubuntu1.14
- 7.81.0-1ubuntu1.15
- Affected ranges
- ECOSYSTEM: < 7.81.0-1ubuntu1.16
Update to 7.81.0-1ubuntu1.16
curl Ubuntu:24.04:LTS
- Versions
- 8.2.1-1ubuntu3
- 8.2.1-1ubuntu3.1
- 8.4.0-2ubuntu1
- 8.5.0-2ubuntu1
- 8.5.0-2ubuntu2
- 8.5.0-2ubuntu8
- 8.5.0-2ubuntu9
- 8.5.0-2ubuntu10
- Affected ranges
- ECOSYSTEM: < 8.5.0-2ubuntu10.1
Update to 8.5.0-2ubuntu10.1
Original sources
- https://curl.se/docs/CVE-2024-2398.json
- https://curl.se/docs/CVE-2024-2398.html
- https://hackerone.com/reports/2402845
- https://lists.fedoraproject.org/archives/list/[email protected]/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/
- http://www.openwall.com/lists/oss-security/2024/03/27/3
- https://security.netapp.com/advisory/ntap-20240503-0009/
- https://support.apple.com/kb/HT214119
- https://support.apple.com/kb/HT214118
- https://support.apple.com/kb/HT214120
- http://seclists.org/fulldisclosure/2024/Jul/20
- http://seclists.org/fulldisclosure/2024/Jul/18
- http://seclists.org/fulldisclosure/2024/Jul/19
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-417159.html
- https://cert-portal.siemens.com/productcert/html/ssa-331112.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-2398