CVE-2024-2398

2024-03-2708:15:41

Debian Security Bug Tracker

security-tracker.debian.org

libcurl

application

http/2

server push

header limit

memory leak

error condition

unix

6.5 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.4%

JSON

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.

OSVersionArchitecturePackageVersionFilename
Debian12allcurl<= 7.88.1-10+deb12u5curl_7.88.1-10+deb12u5_all.deb
Debian11allcurl<= 7.74.0-1.3+deb11u11curl_7.74.0-1.3+deb11u11_all.deb
Debian10allcurl<= 7.64.0-4+deb10u2curl_7.64.0-4+deb10u2_all.deb
Debian999allcurl< 8.7.1-1curl_8.7.1-1_all.deb
Debian13allcurl< 8.7.1-1curl_8.7.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	curl	<= 7.88.1-10+deb12u5	curl_7.88.1-10+deb12u5_all.deb
Debian	11	all	curl	<= 7.74.0-1.3+deb11u11	curl_7.74.0-1.3+deb11u11_all.deb
Debian	10	all	curl	<= 7.64.0-4+deb10u2	curl_7.64.0-4+deb10u2_all.deb
Debian	999	all	curl	< 8.7.1-1	curl_8.7.1-1_all.deb
Debian	13	all	curl	< 8.7.1-1	curl_8.7.1-1_all.deb