When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade curl-minimalUpgrade libcurlUpgrade libcurl-develUpgrade curlUpgrade libcurl-minimal | Aug 22, 2024 | Mar 27, 2024 |
| Alpine Linux | — | Upgrade curl | Jun 6, 2024 | Mar 27, 2024 |
| Amazon Linux Ami 2 | — | Upgrade curlUpgrade libcurlUpgrade curl-debuginfoUpgrade libcurl-devel | May 1, 2024 | Mar 27, 2024 |
| Amazon_linux_2023 | — | Upgrade curl-minimalUpgrade curl-debuginfoUpgrade libcurlUpgrade curl-minimal-debuginfoUpgrade libcurl-develUpgrade libcurl-minimal-debuginfoUpgrade libcurl-minimalUpgrade curlUpgrade libcurl-debuginfoUpgrade curl-debugsource | Feb 17, 2025 | Mar 27, 2024 |
| Apple Osx Curl | — | Upgrade macOS to the latest version | Jul 31, 2024 | Jul 29, 2024 |
| Debian | — | Upgrade curl | Jul 30, 2024 | Mar 27, 2024 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Sep 24, 2024 | Mar 27, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libcurlUpgrade curl | Jul 16, 2024 | Mar 27, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade curlUpgrade libcurl | Jun 26, 2024 | Mar 27, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade curlUpgrade libcurl | Oct 8, 2024 | Mar 27, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade curlUpgrade libcurl-develUpgrade libcurl | Jul 23, 2024 | Mar 27, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade curlUpgrade libcurl | Jul 17, 2024 | Mar 27, 2024 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory6 | Aug 15, 2024 | Mar 27, 2024 |
| Oracle_linux | — | Upgrade libcurlUpgrade libcurl-minimalUpgrade curlUpgrade libcurl-develUpgrade curl-minimal | Oct 16, 2024 | Mar 27, 2024 |
| Redhat_linux | — | Upgrade libcurl-minimalUpgrade curl-minimal-debuginfoUpgrade libcurl-minimal-debuginfoUpgrade curl-debuginfoNo solution existsUpgrade libcurl-debuginfoUpgrade curl-debugsourceUpgrade libcurlUpgrade curlUpgrade libcurl-develUpgrade curl-minimal | Jun 21, 2024 | Mar 27, 2024 |
| Rocky_linux | — | Upgrade curl-debuginfoUpgrade libcurl-debuginfoUpgrade curl-debugsourceUpgrade libcurl-minimalUpgrade curlUpgrade libcurl-develUpgrade libcurlUpgrade libcurl-minimal-debuginfo | May 8, 2025 | Mar 27, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.10Upgrade Splunk Enterprise to version 9.3.5Upgrade Splunk Enterprise to version 9.4.3Upgrade Splunk Enterprise to version 9.2.7 | Jul 30, 2026 | Mar 27, 2024 |
| Suse | — | Upgrade libcurl-mini4Upgrade libcurl4-32bitUpgrade curlUpgrade curl-zsh-completionUpgrade libcurl-develUpgrade libcurl-devel-32bitUpgrade libcurl-devel-docUpgrade libcurl4 | Apr 9, 2024 | Mar 27, 2024 |
| Ubuntu | — | Upgrade curlUpgrade libcurl4t64Upgrade libcurl3 (Ubuntu Pro)Upgrade libcurl3t64-gnutlsUpgrade curl (Ubuntu Pro)Upgrade libcurl3-nss (Ubuntu Pro)Upgrade libcurl4Upgrade libcurl3-gnutls (Ubuntu Pro)Upgrade libcurl3-gnutlsUpgrade libcurl3-nssUpgrade libcurl4 (Ubuntu Pro) | Mar 28, 2024 | Mar 27, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub