CVE details
CVE-2024-2398
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.
Affected ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| ftp/linux-rl9-curl | linux-rl9-curl | 7.76.1_13 | unaddressed | emulation@FreeBSD.org |
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>linux-rl9-curl</name>
<range><lt>8.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When an application tells libcurl it wants to allow HTTP/2 server
push, and the amount of received headers for the push surpasses the
maximum allowed limit (1000), libcurl aborts the server push. When
aborting, libcurl inadvertently does not free all the previously
allocated headers and instead leaks the memory. Further, this error
condition fails silently and is therefore not easily detected by an
application.</p>
</body>
</description>
<references>
<cvename>CVE-2024-2398</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-2398</url>
</references>
<dates>
<discovery>2024-03-27</discovery>
<entry>2026-10-25</entry>
</dates>
</vuln>