CVE-2024-2398
📋 TL;DR
CVE-2024-2398 is a memory leak vulnerability in libcurl that occurs when HTTP/2 server push headers exceed the 1000-header limit. This allows attackers to cause denial of service through resource exhaustion in applications using vulnerable libcurl versions. Any application using libcurl with HTTP/2 server push enabled is affected.
💻 Affected Systems
- libcurl
- curl
- any software using libcurl library
📦 What is this software?
Curl by Haxx
curl is a command-line tool and library for transferring data with URLs. It supports numerous protocols including HTTP, HTTPS, FTP, and more, making it essential for API testing, web scraping, and automated data transfers.
Learn more about Curl →Fedora by Fedoraproject
Fedora by Fedoraproject
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →⚠️ Risk & Real-World Impact
Worst Case
Sustained exploitation could lead to complete system memory exhaustion, causing application crashes and denial of service across affected systems.
Likely Case
Memory consumption gradually increases during HTTP/2 sessions with server push, potentially leading to application instability or crashes over time.
If Mitigated
With HTTP/2 server push disabled or proper monitoring, impact is minimal as the vulnerability requires specific conditions to trigger.
🎯 Exploit Status
Exploitation requires ability to send HTTP/2 server push responses with >1000 headers to a vulnerable client. No authentication needed if network access exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libcurl 8.7.0
Vendor Advisory: https://curl.se/docs/CVE-2024-2398.html
Restart Required: Yes
Instructions:
1. Update libcurl to version 8.7.0 or later. 2. Recompile and redeploy any applications using libcurl. 3. Restart affected services.
🔧 Temporary Workarounds
Disable HTTP/2 server push
allConfigure applications to disable HTTP/2 server push functionality
curl_easy_setopt(curl, CURLOPT_HTTP2_PSEUDO_HEADERS_ORDER, CURL_HTTP2_PSEUDO_HEADERS_ORDER_NONE);
Set CURLOPT_PIPEWAIT to 0
🧯 If You Can't Patch
- Disable HTTP/2 server push in all applications using libcurl
- Implement memory monitoring and alerting for applications using libcurl with HTTP/2
🔍 How to Verify
Check if Vulnerable:
Check libcurl version and verify if HTTP/2 server push is enabled in application configurationCheck Version:
curl --version | head -1Verify Fix Applied:
Verify libcurl version is 8.7.0 or later and test HTTP/2 server push functionality📡 Detection & Monitoring
Log Indicators:
- Memory usage spikes in applications using libcurl
- Application crashes with out-of-memory errors
Network Indicators:
- HTTP/2 traffic with server push headers
- Unusual number of HTTP/2 PUSH_PROMISE frames
SIEM Query:
source="application_logs" AND ("out of memory" OR "memory leak") AND process="*curl*"🔗 References
- http://seclists.org/fulldisclosure/2024/Jul/18
- http://seclists.org/fulldisclosure/2024/Jul/19
- http://seclists.org/fulldisclosure/2024/Jul/20
- http://www.openwall.com/lists/oss-security/2024/03/27/3
- https://curl.se/docs/CVE-2024-2398.html
- https://curl.se/docs/CVE-2024-2398.json
- https://hackerone.com/reports/2402845
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/
- https://security.netapp.com/advisory/ntap-20240503-0009/
- https://support.apple.com/kb/HT214118
- https://support.apple.com/kb/HT214119
- https://support.apple.com/kb/HT214120
- http://seclists.org/fulldisclosure/2024/Jul/18
- http://seclists.org/fulldisclosure/2024/Jul/19
- http://seclists.org/fulldisclosure/2024/Jul/20
- http://www.openwall.com/lists/oss-security/2024/03/27/3
- https://curl.se/docs/CVE-2024-2398.html
- https://curl.se/docs/CVE-2024-2398.json
- https://hackerone.com/reports/2402845
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/
- https://security.netapp.com/advisory/ntap-20240503-0009/
- https://support.apple.com/kb/HT214118
- https://support.apple.com/kb/HT214119
- https://support.apple.com/kb/HT214120
