Skip to content
OpenAdvisories
High USN-6718-2 1 CVE

curl vulnerability

Published Mar 27, 2024 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

USN-6718-1 fixed a vulnerability in curl. This update provides
the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

It was discovered that curl incorrectly handled memory when limiting the
amount of headers when HTTP/2 server push is allowed. A remote attacker
could possibly use this issue to cause curl to consume resources, leading
to a denial of service. (CVE-2024-2398)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS curl 7.47.0-1ubuntu2.19+esm12
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS curl 7.58.0-2ubuntu3.24+esm4

Vulnerabilities 1

  • High 8.6
    CVE-2024-2398 EPSS 36%

    HTTP/2 push headers memory-leak

    When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the prev…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2024-2398