What’s Vulnerable › Vulnerabilities

CVE-2024-2398: HTTP/2 push headers memory-leak

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 36.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-03-27 · updated 2026-10-15
• Weakness: CWE-772

Description

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.

Affected products

• Apple macOS: before 12.7.6; from 13.0 before 13.6.8; from 14.0 before 14.6 — fixed in 12.7.6, 13.6.8, 14.6
• Fedoraproject Fedora: 39, 40
• curl: from 7.44.0 before 8.7.0 — fixed in 8.7.0
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• NetApp Bootstrap Os: all versions
• NetApp Brocade Fabric Operating System: all versions
• NetApp H300S Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H610C Firmware: all versions
• NetApp H610S Firmware: all versions
• NetApp H615C Firmware: all versions
• NetApp H700S Firmware: all versions
• NetApp ONTAP Select Deploy administration utility: all versions

How to fix

Upgrade to a fixed version: Apple macOS 12.7.6, 13.6.8, 14.6; curl 8.7.0. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2024/Jul/18
• http://seclists.org/fulldisclosure/2024/Jul/19
• http://seclists.org/fulldisclosure/2024/Jul/20
• http://www.openwall.com/lists/oss-security/2024/03/27/3
• https://curl.se/docs/CVE-2024-2398.html
• https://curl.se/docs/CVE-2024-2398.json
• https://hackerone.com/reports/2402845
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/
• https://security.netapp.com/advisory/ntap-20240503-0009/
• https://support.apple.com/kb/HT214118
• https://support.apple.com/kb/HT214119

Get alerted when CVE-2024-2398 or the next vulnerability affects your stack