NetSight
IP …
high8.6

CVE-2024-2398

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (10…

Impact

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.

Affected products

VendorProductAffected versions
HaxxCurl
from 7.44.0 before 8.7.0
AppleMacos
before 12.7.6
from 13.0 before 13.6.8
from 14.0 before 14.6
FedoraprojectFedora
Versions 39, 40
NetappActive Iq Unified Manager
All versions
NetappOntap Select Deploy Administration Utility
All versions
NetappBrocade Fabric Operating System
All versions
NetappBootstrap Os
All versions
NetappH300s Firmware
All versions
NetappH410s Firmware
All versions
NetappH500s Firmware
All versions
NetappH610c Firmware
All versions
NetappH610s Firmware
All versions

Weakness classification

CWE-772

References