CVE-2024-6874

2024-07-2506:41:23

redhat.com

access.redhat.com

buffer overread

curl

url api

cve-2024-6874

remote attacker

sensitive information

punycode

flaw

specially crafted request

further attacks

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

6.4

Confidence

Low

EPSS

0.001

Percentile

35.1%

JSON

A buffer overread vulnerability was found in Curl’s URL API function curl_url_get(). This issue allows a remote attacker to obtain sensitive information due to a punycode buffer overread flaw. By sending a specially crafted request, an attacker can gain sensitive information and potentially launch further attacks against the affected system.