When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libcurlUpgrade curl-minimalUpgrade libcurl-develUpgrade libcurl-minimalUpgrade curl | Aug 22, 2024 | Mar 27, 2024 |
| Alpine Linux | — | Upgrade curl | Jun 6, 2024 | Mar 27, 2024 |
| Amazon Linux Ami 2 | — | Upgrade libcurl-develUpgrade libcurlUpgrade curl-debuginfoUpgrade curl | May 1, 2024 | Mar 27, 2024 |
| Amazon_linux_2023 | — | Upgrade curl-debugsourceUpgrade libcurl-minimalUpgrade curlUpgrade libcurl-debuginfoUpgrade libcurl-develUpgrade curl-debuginfoUpgrade curl-minimalUpgrade libcurlUpgrade curl-minimal-debuginfoUpgrade libcurl-minimal-debuginfo | Feb 17, 2025 | Mar 27, 2024 |
| Apple Osx Curl | — | Upgrade macOS to the latest version | Jul 31, 2024 | Jul 29, 2024 |
| Debian | — | Upgrade curl | Jul 30, 2024 | Mar 27, 2024 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Sep 24, 2024 | Mar 27, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libcurlUpgrade curl | Jul 16, 2024 | Mar 27, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libcurlUpgrade curl | Jun 26, 2024 | Mar 27, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libcurlUpgrade curl | Oct 8, 2024 | Mar 27, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade curlUpgrade libcurl-develUpgrade libcurl | Jul 23, 2024 | Mar 27, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libcurlUpgrade curl | Jul 17, 2024 | Mar 27, 2024 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory6 | Aug 15, 2024 | Mar 27, 2024 |
| Oracle_linux | — | Upgrade libcurlUpgrade libcurl-minimalUpgrade curlUpgrade curl-minimalUpgrade libcurl-devel | Oct 16, 2024 | Mar 27, 2024 |
| Redhat_linux | — | Upgrade curl-minimal-debuginfoUpgrade libcurl-minimal-debuginfoUpgrade libcurl-minimalUpgrade curl-debuginfoUpgrade curl-minimalUpgrade libcurl-develUpgrade libcurl-debuginfoUpgrade curlUpgrade curl-debugsourceNo solution existsUpgrade libcurl | Jun 21, 2024 | Mar 27, 2024 |
| Rocky_linux | — | Upgrade libcurl-develUpgrade libcurlUpgrade curlUpgrade libcurl-minimal-debuginfoUpgrade curl-debuginfoUpgrade curl-debugsourceUpgrade libcurl-minimalUpgrade libcurl-debuginfo | May 8, 2025 | Mar 27, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.10Upgrade Splunk Enterprise to version 9.2.7Upgrade Splunk Enterprise to version 9.4.3Upgrade Splunk Enterprise to version 9.3.5 | Jul 30, 2026 | Mar 27, 2024 |
| Suse | — | Upgrade curl-zsh-completionUpgrade libcurl4-32bitUpgrade libcurl-devel-32bitUpgrade libcurl-mini4Upgrade libcurl-develUpgrade curlUpgrade libcurl4Upgrade libcurl-devel-doc | Apr 9, 2024 | Mar 27, 2024 |
| Ubuntu | — | Upgrade curlUpgrade libcurl3t64-gnutlsUpgrade libcurl4t64Upgrade libcurl3 (Ubuntu Pro)Upgrade libcurl3-nss (Ubuntu Pro)Upgrade curl (Ubuntu Pro)Upgrade libcurl3-gnutlsUpgrade libcurl4Upgrade libcurl4 (Ubuntu Pro)Upgrade libcurl3-nssUpgrade libcurl3-gnutls (Ubuntu Pro) | Mar 28, 2024 | Mar 27, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 27, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub