When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade curl-minimalUpgrade libcurlUpgrade curlUpgrade libcurl-minimalUpgrade libcurl-devel | Aug 22, 2024 | Mar 27, 2024 |
| Alpine Linux | — | Upgrade curl | Jun 6, 2024 | Mar 27, 2024 |
| Amazon Linux Ami 2 | — | Upgrade curlUpgrade curl-debuginfoUpgrade libcurl-develUpgrade libcurl | May 1, 2024 | Mar 27, 2024 |
| Amazon_linux_2023 | — | Upgrade libcurl-minimalUpgrade curl-debugsourceUpgrade curlUpgrade libcurl-debuginfoUpgrade curl-minimal-debuginfoUpgrade libcurl-minimal-debuginfoUpgrade curl-minimalUpgrade libcurlUpgrade libcurl-develUpgrade curl-debuginfo | Feb 17, 2025 | Mar 27, 2024 |
| Apple Osx Curl | — | Upgrade macOS to the latest version | Jul 31, 2024 | Jul 29, 2024 |
| Debian | — | Upgrade curl | Jul 30, 2024 | Mar 27, 2024 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Sep 24, 2024 | Mar 27, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libcurlUpgrade curl | Jul 16, 2024 | Mar 27, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade curlUpgrade libcurl | Jun 26, 2024 | Mar 27, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libcurlUpgrade curl | Oct 8, 2024 | Mar 27, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade curlUpgrade libcurl-develUpgrade libcurl | Jul 23, 2024 | Mar 27, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade curlUpgrade libcurl | Jul 17, 2024 | Mar 27, 2024 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory6 | Aug 15, 2024 | Mar 27, 2024 |
| Oracle_linux | — | Upgrade curl-minimalUpgrade libcurl-develUpgrade libcurl-minimalUpgrade curlUpgrade libcurl | Oct 16, 2024 | Mar 27, 2024 |
| Redhat_linux | — | Upgrade libcurl-develUpgrade libcurl-debuginfoUpgrade libcurlUpgrade curlUpgrade curl-minimalNo solution existsUpgrade curl-debugsourceUpgrade curl-debuginfoUpgrade libcurl-minimal-debuginfoUpgrade curl-minimal-debuginfoUpgrade libcurl-minimal | Jun 21, 2024 | Mar 27, 2024 |
| Rocky_linux | — | Upgrade curlUpgrade libcurl-develUpgrade libcurlUpgrade libcurl-minimal-debuginfoUpgrade curl-debugsourceUpgrade libcurl-debuginfoUpgrade libcurl-minimalUpgrade curl-debuginfo | May 8, 2025 | Mar 27, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.10Upgrade Splunk Enterprise to version 9.4.3Upgrade Splunk Enterprise to version 9.2.7Upgrade Splunk Enterprise to version 9.3.5 | Jul 30, 2026 | Mar 27, 2024 |
| Suse | — | Upgrade libcurl-mini4Upgrade libcurl-devel-32bitUpgrade libcurl-develUpgrade libcurl4-32bitUpgrade curl-zsh-completionUpgrade curlUpgrade libcurl4Upgrade libcurl-devel-doc | Apr 9, 2024 | Mar 27, 2024 |
| Ubuntu | — | Upgrade libcurl4Upgrade libcurl4 (Ubuntu Pro)Upgrade libcurl3-nssUpgrade libcurl3-gnutlsUpgrade libcurl3-gnutls (Ubuntu Pro)Upgrade curl (Ubuntu Pro)Upgrade libcurl4t64Upgrade libcurl3t64-gnutlsUpgrade curlUpgrade libcurl3 (Ubuntu Pro)Upgrade libcurl3-nss (Ubuntu Pro) | Mar 28, 2024 | Mar 27, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub