Skip to content
OpenAdvisories
High RHSA-2024:5529 1 CVE

Red Hat Security Advisory: curl security update

Published Sep 30, 2024 · Updated Oct 15, 2026

Ecosystem: Red Hat

Fixed packages 15

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream curl-debuginfo 0:7.76.1-29.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::appstream curl-debugsource 0:7.76.1-29.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::appstream curl-minimal-debuginfo 0:7.76.1-29.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::appstream libcurl-debuginfo 0:7.76.1-29.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::appstream libcurl-devel 0:7.76.1-29.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::appstream libcurl-minimal-debuginfo 0:7.76.1-29.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::baseos curl 0:7.76.1-29.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::baseos curl-debuginfo 0:7.76.1-29.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::baseos curl-debugsource 0:7.76.1-29.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::baseos curl-minimal 0:7.76.1-29.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::baseos curl-minimal-debuginfo 0:7.76.1-29.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::baseos libcurl 0:7.76.1-29.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::baseos libcurl-debuginfo 0:7.76.1-29.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::baseos libcurl-minimal 0:7.76.1-29.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::baseos libcurl-minimal-debuginfo 0:7.76.1-29.el9_4.1

Vulnerabilities 1

  • High 8.6
    CVE-2024-2398 EPSS 36%

    HTTP/2 push headers memory-leak

    When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the prev…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2270498
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5529.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-2398
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-2398
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-2398
  • article
    https://curl.se/docs/CVE-2024-2398.html