Secuno
ENNL
Book demo

CVE-2024-2398

Haxx Curl vulnerability

8.6 HIGHPublic exploitEPSS 36.1%
  1. Published27 Mar 2024

Description

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityLow
AvailabilityLow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Affected products

Haxx Curl≥ 7.44.0 < 8.7.0
Netapp Active Iq Unified Managerall versions
Netapp Ontap Select Deploy Administration Utilityall versions
Apple macOS≥ 13.0 < 13.6.8 · ≥ 14.0 < 14.6 · < 12.7.6
Fedoraproject Fedora39 · 40
Netapp Bootstrap OSall versions
Netapp Brocade Fabric Operating Systemall versions
Netapp H300s Firmwareall versions
Netapp H410s Firmwareall versions
Netapp H500s Firmwareall versions
Netapp H610c Firmwareall versions
Netapp H610s Firmwareall versions
Netapp H615c Firmwareall versions
Netapp H700s Firmwareall versions

Remediation

Fixed in
Haxx Curl≥ 8.7.0
Apple macOS≥ 13.6.8

References

and 3 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-202508.6
A vulnerability in Datagram TLS (DTLS) message handling of Cisco Secure Firewall…
CVE-2026-398309.1
A malicious SSH peer could send unsolicited global request responses to fill an…
CVE-2026-200828.6
A vulnerability in the handling of the embryonic connection limits in Cisco Secure…
CVE-2025-302568.6
A denial of service vulnerability exists in the HTTP Header Parsing functionality of…
CVE-2023-200958.6
A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance…
CVE-2017-131468.8
In ImageMagick before 6.9.8-5 and 7.x before 7.0.5-6, there is a memory leak in the…

Frequently asked

Is CVE-2024-2398 being actively exploited?

CVE-2024-2398 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 36.1%.

How severe is CVE-2024-2398?

CVE-2024-2398 has a CVSS 3.1 base score of 8.6, rated high. EPSS estimates a 36.1% probability of exploitation.

Which products are affected by CVE-2024-2398?

Affected products include Haxx Curl, Netapp Active Iq Unified Manager, Netapp Ontap Select Deploy Administration Utility, Apple macOS, Fedoraproject Fedora, and 9 more.

How do I fix CVE-2024-2398?

Upgrade affected software to a fixed version, for example Haxx Curl 8.7.0, Apple macOS 13.6.8 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-2398 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.