CVE-2024-2398

HTTP/2 push headers memory-leak

Severity Score

8.6

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.

Cuando una aplicación le dice a libcurl que quiere permitir la inserción del servidor HTTP/2 y la cantidad de encabezados recibidos para la inserción supera el límite máximo permitido (1000), libcurl cancela la inserción del servidor. Al cancelar, libcurl inadvertidamente no libera todos los encabezados previamente asignados y, en cambio, pierde memoria. Además, esta condición de error falla silenciosamente y, por lo tanto, una aplicación no la detecta fácilmente.

A flaw was found in curl. When an application configures libcurl to use HTTP/2 server push and the amount of received headers for the push surpasses the maximum allowed limit, libcurl aborts the server push. When aborting, libcurl does not free all the previously allocated headers, resulting in a memory leak.

*Credits: w0x42 on hackerone, Stefan Eissing

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

None

Automatable

Yes

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-03-12 CVE Reserved
2024-03-27 CVE Published
2024-07-30 EPSS Updated
2024-08-01 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-772: Missing Release of Resource after Effective Lifetime

CAPEC

References (15)

URL	Tag	Source
http://www.openwall.com/lists/oss-security/2024/03/27/3
https://curl.se/docs/CVE-2024-2398.html
https://curl.se/docs/CVE-2024-2398.json
https://hackerone.com/reports/2402845
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI
https://security.netapp.com/advisory/ntap-20240503-0009
https://support.apple.com/kb/HT214119
https://support.apple.com/kb/HT214118
https://support.apple.com/kb/HT214120
http://seclists.org/fulldisclosure/2024/Jul/20
http://seclists.org/fulldisclosure/2024/Jul/18
http://seclists.org/fulldisclosure/2024/Jul/19

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2024-2398	2024-09-30
https://bugzilla.redhat.com/show_bug.cgi?id=2270498	2024-09-30

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				8.6.0 Search vendor "Curl" for product "Curl" and version "8.6.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				8.5.0 Search vendor "Curl" for product "Curl" and version "8.5.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				8.4.0 Search vendor "Curl" for product "Curl" and version "8.4.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				8.3.0 Search vendor "Curl" for product "Curl" and version "8.3.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				8.2.1 Search vendor "Curl" for product "Curl" and version "8.2.1"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				8.2.0 Search vendor "Curl" for product "Curl" and version "8.2.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				8.1.2 Search vendor "Curl" for product "Curl" and version "8.1.2"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				8.1.1 Search vendor "Curl" for product "Curl" and version "8.1.1"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				8.1.0 Search vendor "Curl" for product "Curl" and version "8.1.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				8.0.1 Search vendor "Curl" for product "Curl" and version "8.0.1"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				8.0.0 Search vendor "Curl" for product "Curl" and version "8.0.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.88.1 Search vendor "Curl" for product "Curl" and version "7.88.1"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.88.0 Search vendor "Curl" for product "Curl" and version "7.88.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.87.0 Search vendor "Curl" for product "Curl" and version "7.87.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.86.0 Search vendor "Curl" for product "Curl" and version "7.86.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.85.0 Search vendor "Curl" for product "Curl" and version "7.85.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.84.0 Search vendor "Curl" for product "Curl" and version "7.84.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.83.1 Search vendor "Curl" for product "Curl" and version "7.83.1"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.83.0 Search vendor "Curl" for product "Curl" and version "7.83.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.82.0 Search vendor "Curl" for product "Curl" and version "7.82.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.81.0 Search vendor "Curl" for product "Curl" and version "7.81.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.80.0 Search vendor "Curl" for product "Curl" and version "7.80.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.79.1 Search vendor "Curl" for product "Curl" and version "7.79.1"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.79.0 Search vendor "Curl" for product "Curl" and version "7.79.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.78.0 Search vendor "Curl" for product "Curl" and version "7.78.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.77.0 Search vendor "Curl" for product "Curl" and version "7.77.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.76.1 Search vendor "Curl" for product "Curl" and version "7.76.1"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.76.0 Search vendor "Curl" for product "Curl" and version "7.76.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.75.0 Search vendor "Curl" for product "Curl" and version "7.75.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.74.0 Search vendor "Curl" for product "Curl" and version "7.74.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.73.0 Search vendor "Curl" for product "Curl" and version "7.73.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.72.0 Search vendor "Curl" for product "Curl" and version "7.72.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.71.1 Search vendor "Curl" for product "Curl" and version "7.71.1"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.71.0 Search vendor "Curl" for product "Curl" and version "7.71.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.70.0 Search vendor "Curl" for product "Curl" and version "7.70.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.69.1 Search vendor "Curl" for product "Curl" and version "7.69.1"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.69.0 Search vendor "Curl" for product "Curl" and version "7.69.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.68.0 Search vendor "Curl" for product "Curl" and version "7.68.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.67.0 Search vendor "Curl" for product "Curl" and version "7.67.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.66.0 Search vendor "Curl" for product "Curl" and version "7.66.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.65.3 Search vendor "Curl" for product "Curl" and version "7.65.3"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.65.2 Search vendor "Curl" for product "Curl" and version "7.65.2"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.65.1 Search vendor "Curl" for product "Curl" and version "7.65.1"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.65.0 Search vendor "Curl" for product "Curl" and version "7.65.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.64.1 Search vendor "Curl" for product "Curl" and version "7.64.1"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.64.0 Search vendor "Curl" for product "Curl" and version "7.64.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.63.0 Search vendor "Curl" for product "Curl" and version "7.63.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.62.0 Search vendor "Curl" for product "Curl" and version "7.62.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.61.1 Search vendor "Curl" for product "Curl" and version "7.61.1"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.61.0 Search vendor "Curl" for product "Curl" and version "7.61.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.60.0 Search vendor "Curl" for product "Curl" and version "7.60.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.59.0 Search vendor "Curl" for product "Curl" and version "7.59.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.58.0 Search vendor "Curl" for product "Curl" and version "7.58.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.57.0 Search vendor "Curl" for product "Curl" and version "7.57.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.56.1 Search vendor "Curl" for product "Curl" and version "7.56.1"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.56.0 Search vendor "Curl" for product "Curl" and version "7.56.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.55.1 Search vendor "Curl" for product "Curl" and version "7.55.1"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.55.0 Search vendor "Curl" for product "Curl" and version "7.55.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.54.1 Search vendor "Curl" for product "Curl" and version "7.54.1"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.54.0 Search vendor "Curl" for product "Curl" and version "7.54.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.53.1 Search vendor "Curl" for product "Curl" and version "7.53.1"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.53.0 Search vendor "Curl" for product "Curl" and version "7.53.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.52.1 Search vendor "Curl" for product "Curl" and version "7.52.1"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.52.0 Search vendor "Curl" for product "Curl" and version "7.52.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.51.0 Search vendor "Curl" for product "Curl" and version "7.51.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.50.3 Search vendor "Curl" for product "Curl" and version "7.50.3"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.50.2 Search vendor "Curl" for product "Curl" and version "7.50.2"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.50.1 Search vendor "Curl" for product "Curl" and version "7.50.1"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.50.0 Search vendor "Curl" for product "Curl" and version "7.50.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.49.1 Search vendor "Curl" for product "Curl" and version "7.49.1"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.49.0 Search vendor "Curl" for product "Curl" and version "7.49.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.48.0 Search vendor "Curl" for product "Curl" and version "7.48.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.47.1 Search vendor "Curl" for product "Curl" and version "7.47.1"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.47.0 Search vendor "Curl" for product "Curl" and version "7.47.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.46.0 Search vendor "Curl" for product "Curl" and version "7.46.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.45.0 Search vendor "Curl" for product "Curl" and version "7.45.0"		en		Affected
Curl Search vendor "Curl"		Curl Search vendor "Curl" for product "Curl"				7.44.0 Search vendor "Curl" for product "Curl" and version "7.44.0"		en		Affected