CVE-2024-2398 — HTTP/2 push headers memory-leak

Description

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.

Affected products

Vendor	Product	Affected	Fixed
curl	curl	8.6.0 – ≤ 8.6.0, 8.5.0 – ≤ 8.5.0, 8.4.0 – ≤ 8.4.0, 8.3.0 – ≤ 8.3.0, 8.2.1 – ≤ 8.2.1, 8.2.0 – ≤ 8.2.0, 8.1.2 – ≤ 8.1.2, 8.1.1 – ≤ 8.1.1, 8.1.0 – ≤ 8.1.0, 8.0.1 – ≤ 8.0.1, 8.0.0 – ≤ 8.0.0, 7.88.1 – ≤ 7.88.1, 7.88.0 – ≤ 7.88.0, 7.87.0 – ≤ 7.87.0, 7.86.0 – ≤ 7.86.0, 7.85.0 – ≤ 7.85.0, 7.84.0 – ≤ 7.84.0…	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	curl	8.7.1-1	—
Debian 13	curl	8.7.1-1	—
Debian 12	curl	7.88.1-10+deb12u6	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 24.04 LTS	curl	8.5.0-2ubuntu10.1	USN-6718-3
Ubuntu 22.04 LTS	curl	7.81.0-1ubuntu1.16	USN-6718-1
Ubuntu 20.04 LTS	curl	7.68.0-1ubuntu2.22	USN-6718-1

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 18.04 LTS	curl	7.58.0-2ubuntu3.24+esm4	USN-6718-2
Ubuntu Pro 16.04 LTS	curl	7.47.0-1ubuntu2.19+esm12	USN-6718-2

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	curl +4	7.76.1-29.el9_4.1	RHSA-2024:5529
RHEL 8	curl +3	7.61.1-34.el8_10.2	RHSA-2024:5654

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 9.2 EUS	curl +4	7.76.1-23.el9_2.7	RHSA-2024:3998
Red Hat JBoss Core Services 1	jbcs-httpd24-curl +2	8.7.1-2.el7jbcs	RHSA-2024:2693
Red Hat JBoss Core Services 1	jbcs-httpd24-httpd +6	2.4.57-10.el7jbcs	RHSA-2024:2693
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_http2	1.15.19-37.el7jbcs	RHSA-2024:2693
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_jk +1	1.2.49-6.redhat_1.el7jbcs	RHSA-2024:2693
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_md	1:2.4.24-6.el7jbcs	RHSA-2024:2693
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_proxy_cluster	1.3.20-4.el7jbcs	RHSA-2024:2693
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_security	2.9.3-36.el7jbcs	RHSA-2024:2693
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_ssl +1	1:2.4.57-10.el7jbcs	RHSA-2024:2693
Red Hat JBoss Core Services 1	jbcs-httpd24-nghttp2 +1	1.43.0-13.el7jbcs	RHSA-2024:2693

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	curl +4	7.76.1-29.el9_4.1	ALSA-2024:5529
AlmaLinux 8	curl +3	7.61.1-34.el8_10.2	ALSA-2024:5654

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 8	curl	7.61.1-34.el8_10.2	RLSA-2024:5654

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP5	curl	8.0.1-150400.5.44.1	SUSE-SU-2024:1151-1
SLES 15 SP4	curl	8.0.1-150400.5.44.1	SUSE-SU-2024:1151-2
SLES 12 SP5	curl	8.0.1-11.86.2	SUSE-SU-2024:1150-1

Show 13 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 15 SP4	curl	8.0.1-150400.5.44.1	SUSE-SU-2024:1151-2
SLES for SAP 12 SP5	curl	8.0.1-11.86.2	SUSE-SU-2024:1150-1
SLE Micro 6.0	curl	8.6.0-3.1	SUSE-SU-2025:20029-1
SLE Micro 5.5	curl	8.0.1-150400.5.44.1	SUSE-SU-2024:1151-3, SUSE-SU-2024:1151-1
SLE Micro 5.4	curl	8.0.1-150400.5.44.1	SUSE-SU-2024:1151-1
SLE Micro 5.3	curl	8.0.1-150400.5.44.1	SUSE-SU-2024:1151-1
SLE Micro 5.2	curl	7.66.0-150200.4.69.1	SUSE-SU-2024:1120-1
SLE Micro 5.1	curl	7.66.0-150200.4.69.1	SUSE-SU-2024:1120-1
SLE HPC 15 SP4	curl	8.0.1-150400.5.44.1	SUSE-SU-2024:1151-2
SUSE Manager Server 4.3	curl	8.0.1-150400.5.44.1	SUSE-SU-2024:1151-2
SUSE Manager Proxy 4.3	curl	8.0.1-150400.5.44.1	SUSE-SU-2024:1151-2
SUSE Linux Enterprise Installer Updates 15 SP5	curl	8.0.1-150400.5.44.1	SUSE-SU-2024:1151-1
SUSE Linux Enterprise Installer Updates 15 SP4	curl	8.0.1-150400.5.44.1	SUSE-SU-2024:1151-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	curl	8.7.1-1.1	openSUSE-SU-2024:13805-1
openSUSE Leap 15.5	curl	8.0.1-150400.5.44.1	SUSE-SU-2024:1151-1

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
openSUSE Leap Micro 5.4	curl	8.0.1-150400.5.44.1	SUSE-SU-2024:1151-1
openSUSE Leap Micro 5.3	curl	8.0.1-150400.5.44.1	SUSE-SU-2024:1151-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	curl	8.7.1-r0	—
Alpine v3.23	curl	8.7.1-r0	—
Alpine v3.22	curl	8.7.1-r0	—
Alpine v3.21	curl	8.7.1-r0	—
Alpine v3.20	curl	8.7.1-r0	—

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	curl	8.7.1-r0	—
Alpine v3.18	curl	8.7.1-r0	—
Alpine v3.17	curl	8.7.1-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	curl +4	8.5.0-1.amzn2023.0.4	ALAS2023-2024-596
Amazon Linux 2	curl +2	8.3.0-1.amzn2.0.7	ALAS2-2024-2526

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	cmake	3.30.3-2	—
Azure Linux 3	curl	8.8.0-1	—
Azure Linux 2 (CBL-Mariner)	cmake	3.21.4-14	—
Azure Linux 2 (CBL-Mariner)	curl	8.8.0-1	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	curl +4	7.76.1-29.el9_4.1	ELSA-2024-5529
Oracle Linux 8	curl +3	7.61.1-34.el8_10.2	ELSA-2024-5654

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	curl	8.7.1-r0	—

Advisories 39

ALSA-2024:5529 Moderate: curl security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2024:5654 Moderate: curl security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2024:5654 Red Hat Security Advisory: curl security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
RHSA-2024:5529 Red Hat Security Advisory: curl security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
RHSA-2024:3998 Red Hat Security Advisory: curl security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
RHSA-2024:2693 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
WID-SEC-2025-0001 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
WID-SEC-2024-3195 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
USN-6718-2 curl vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
WID-SEC-2024-0726 cURL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 8, 2026
ICSA-24-319-16 Hitachi Energy MSM (Update A) CISA ICS & IT advisories · May 5, 2026
USN-6718-1 curl vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
USN-6718-3 curl vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
SUSE-SU-2025:20029-1 Security update for curl SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2024:1151-2 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:1151-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:13805-1 curl-8.7.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:1120-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:1151-3 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:1150-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2024-1725 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 11, 2026
WID-SEC-2025-0225 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 1, 2025
WID-SEC-2024-1474 Red Hat OpenShift Container Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 26, 2025
ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025
RLSA-2024:5654 Moderate: curl security update Rocky Linux Security Advisories · May 7, 2025
NCSC-2024-0433 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Nov 12, 2024
ICSA-24-319-04 Siemens SINEC NMS CISA ICS & IT advisories · Nov 12, 2024
SSA-331112 SSA-331112: Multiple Vulnerabilities in SINEC NMS Before V3.0 SP1 Siemens ProductCERT · Nov 12, 2024
NCSC-2024-0414 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Oct 17, 2024
NCSC-2024-0362 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Sep 10, 2024
ICSA-24-256-10 Siemens SINEMA CISA ICS & IT advisories · Sep 10, 2024
SSA-417159 SSA-417159: Multiple Vulnerabilities in SINEMA Remote Connect Client Before V3.2 SP2 Siemens ProductCERT · Sep 10, 2024
ELSA-2024-5654 Moderate: curl security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 20, 2024
ELSA-2024-5529 Moderate: curl security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 19, 2024
NCSC-2024-0339 Kwetsbaarheden verholpen in Microsoft Mariner NCSC-NL (Netherlands) · Aug 13, 2024
NCSC-2024-0320 Kwetsbaarheden verholpen in Apple MacOS NCSC-NL (Netherlands) · Jul 30, 2024
ALAS2023-2024-596 Moderate: curl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 25, 2024
ALAS2-2024-2526 Moderate: curl security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 24, 2024

EUVD	v3.1	8.6
CISA-ADP	v3.1	8.6

HTTP/2 push headers memory-leak

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Alpine

Amazon Linux

Azure Linux

Oracle Linux

Wolfi

Advisories 39

References