Skip to content
OpenAdvisories
Medium USN-7104-1 1 CVE

curl vulnerability

Published Nov 18, 2024 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that curl could overwrite the HSTS expiry of the parent
domain with the subdomain's HSTS entry. This could lead to curl switching
back to insecure HTTP earlier than otherwise intended, resulting in
information exposure.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS curl 7.81.0-1ubuntu1.19
Ubuntu · 24.04 LTS 24.04:LTS curl 8.5.0-2ubuntu10.5

Vulnerabilities 1

  • Medium 5.9
    CVE-2024-9681

    HSTS subdomain overwrites parent cache entry

    When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2024-9681