Back
CVE-2024-2398
HTTP/2 push headers memory-leak
High8.6EPSS 36.1%
- Published
- Updated
- Reserved
- Assigned by
- curl
Description
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.
Timeline
ID reserved
By curl
- 15 days later
· 15 days later
Published
- 3 years later
· 3 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | High8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L |
| NVDNVD · Modified | 3.1 | High8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L |
- EPSS (exploitation in 30 days)
- 36.1% · top 1.5% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.6.
Weakness
- CWE-772 Missing Release of Resource after Effective Lifetime
- CWE-772 (opens in a new tab)All about CWE-772 and its CVEs
Affected products
- affected 8.6.0 – ≤ 8.6.0
- affected 8.5.0 – ≤ 8.5.0
- affected 8.4.0 – ≤ 8.4.0
- affected 8.3.0 – ≤ 8.3.0
- affected 8.2.1 – ≤ 8.2.1
- affected 8.2.0 – ≤ 8.2.0
- affected 8.1.2 – ≤ 8.1.2
- affected 8.1.1 – ≤ 8.1.1
- affected 8.1.0 – ≤ 8.1.0
- affected 8.0.1 – ≤ 8.0.1
- affected 8.0.0 – ≤ 8.0.0
- affected 7.88.1 – ≤ 7.88.1
- affected 7.88.0 – ≤ 7.88.0
- affected 7.87.0 – ≤ 7.87.0
- affected 7.86.0 – ≤ 7.86.0
- affected 7.85.0 – ≤ 7.85.0
- affected 7.84.0 – ≤ 7.84.0
- affected 7.83.1 – ≤ 7.83.1
- affected 7.83.0 – ≤ 7.83.0
- affected 7.82.0 – ≤ 7.82.0
- affected 7.81.0 – ≤ 7.81.0
- affected 7.80.0 – ≤ 7.80.0
- affected 7.79.1 – ≤ 7.79.1
- affected 7.79.0 – ≤ 7.79.0
- affected 7.78.0 – ≤ 7.78.0
- affected 7.77.0 – ≤ 7.77.0
- affected 7.76.1 – ≤ 7.76.1
- affected 7.76.0 – ≤ 7.76.0
- affected 7.75.0 – ≤ 7.75.0
- affected 7.74.0 – ≤ 7.74.0
- affected 7.73.0 – ≤ 7.73.0
- affected 7.72.0 – ≤ 7.72.0
- affected 7.71.1 – ≤ 7.71.1
- affected 7.71.0 – ≤ 7.71.0
- affected 7.70.0 – ≤ 7.70.0
- affected 7.69.1 – ≤ 7.69.1
- affected 7.69.0 – ≤ 7.69.0
- affected 7.68.0 – ≤ 7.68.0
- affected 7.67.0 – ≤ 7.67.0
- affected 7.66.0 – ≤ 7.66.0
- and 37 more
References (16)
- json (opens in a new tab)x_transferred
- www (opens in a new tab)x_transferred
- issue (opens in a new tab)x_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/ (opens in a new tab)x_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/ (opens in a new tab)x_transferred
- http://www.openwall.com/lists/oss-security/2024/03/27/3 (opens in a new tab)x_transferred
- https://security.netapp.com/advisory/ntap-20240503-0009/ (opens in a new tab)x_transferred
- https://support.apple.com/kb/HT214119 (opens in a new tab)x_transferred
- https://support.apple.com/kb/HT214118 (opens in a new tab)x_transferred
- https://support.apple.com/kb/HT214120 (opens in a new tab)x_transferred
- http://seclists.org/fulldisclosure/2024/Jul/20 (opens in a new tab)x_transferred
- http://seclists.org/fulldisclosure/2024/Jul/18 (opens in a new tab)x_transferred
- http://seclists.org/fulldisclosure/2024/Jul/19 (opens in a new tab)x_transferred
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-417159.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-331112.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2024-2398)Record last updated .