HTTP/2 push headers memory-leak

2024-03-2708:00:00

Google

osv.dev

http/2

server push

memory leak

libcurl

error condition

software

header

9.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.4%

JSON

When an application tells libcurl it wants to allow HTTP/2 server push, and
the amount of received headers for the push surpasses the maximum allowed
limit (1000), libcurl aborts the server push. When aborting, libcurl
inadvertently does not free all the previously allocated headers and instead
leaks the memory.

Further, this error condition fails silently and is therefore not easily
detected by an application.

CPENameOperatorVersion
curl.giteq7.76.1
curl.giteq7.56.1
curl.giteq7.61.1
curl.giteq8.0.1
curl.giteq7.62.0
curl.giteq7.52.1
curl.giteq7.57.0
curl.giteq7.52.0
curl.giteq8.1.2
curl.giteq7.53.0

Name	Operator	Version
curl.git	eq	7.76.1
curl.git	eq	7.56.1
curl.git	eq	7.61.1
curl.git	eq	8.0.1
curl.git	eq	7.62.0
curl.git	eq	7.52.1
curl.git	eq	7.57.0
curl.git	eq	7.52.0
curl.git	eq	8.1.2
curl.git	eq	7.53.0