CVE-2024-2004 — Usage of disabled protocol

Back Back to CVE browser

MEDIUM

Usage of disabled protocol

Published Mar 27, 2024

5.3

MEDIUM

CVSS 3.1

EPSS 1.68%

Description

When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.

Affected products

Vendor Curl Product Curl Default
unaffected
- Version
  7.85.0
  Status
  affected
  Constraints
  <=7.85.0
- Version
  7.86.0
  Status
  affected
  Constraints
  <=7.86.0
- Version
  7.87.0
  Status
  affected
  Constraints
  <=7.87.0
- Version
  7.88.0
  Status
  affected
  Constraints
  <=7.88.0
- Version
  7.88.1
  Status
  affected
  Constraints
  <=7.88.1
- Version
  8.0.0
  Status
  affected
  Constraints
  <=8.0.0
- Version
  8.0.1
  Status
  affected
  Constraints
  <=8.0.1
- Version
  8.1.0
  Status
  affected
  Constraints
  <=8.1.0
- Version
  8.1.1
  Status
  affected
  Constraints
  <=8.1.1
- Version
  8.1.2
  Status
  affected
  Constraints
  <=8.1.2
- Version
  8.2.0
  Status
  affected
  Constraints
  <=8.2.0
- Version
  8.2.1
  Status
  affected
  Constraints
  <=8.2.1
- Version
  8.3.0
  Status
  affected
  Constraints
  <=8.3.0
- Version
  8.4.0
  Status
  affected
  Constraints
  <=8.4.0
- Version
  8.5.0
  Status
  affected
  Constraints
  <=8.5.0
- Version
  8.6.0
  Status
  affected
  Constraints
  <=8.6.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Curl

unaffected

Version	Status	Constraints
7.85.0	affected	<=7.85.0
7.86.0	affected	<=7.86.0
7.87.0	affected	<=7.87.0
7.88.0	affected	<=7.88.0
7.88.1	affected	<=7.88.1
8.0.0	affected	<=8.0.0
8.0.1	affected	<=8.0.1
8.1.0	affected	<=8.1.0
8.1.1	affected	<=8.1.1
8.1.2	affected	<=8.1.2
8.2.0	affected	<=8.2.0
8.2.1	affected	<=8.2.1
8.3.0	affected	<=8.3.0
8.4.0	affected	<=8.4.0
8.5.0	affected	<=8.5.0
8.6.0	affected	<=8.6.0

JBoss Core Services for RHEL 8

jbcs-httpd24-curl-0:8.7.1-2.el8jbcs

Fixed · RHSA-2024:2693
JBoss Core Services for RHEL 8

jbcs-httpd24-httpd-0:2.4.57-10.el8jbcs

Fixed · RHSA-2024:2693
JBoss Core Services for RHEL 8

jbcs-httpd24-mod_http2-0:1.15.19-37.el8jbcs

Fixed · RHSA-2024:2693
JBoss Core Services for RHEL 8

jbcs-httpd24-mod_jk-0:1.2.49-6.redhat_1.el8jbcs

Fixed · RHSA-2024:2693
JBoss Core Services for RHEL 8

jbcs-httpd24-mod_md-1:2.4.24-6.el8jbcs

Fixed · RHSA-2024:2693
JBoss Core Services for RHEL 8

jbcs-httpd24-mod_proxy_cluster-0:1.3.20-4.el8jbcs

Fixed · RHSA-2024:2693
JBoss Core Services for RHEL 8

jbcs-httpd24-mod_security-0:2.9.3-36.el8jbcs

Fixed · RHSA-2024:2693
JBoss Core Services for RHEL 8

jbcs-httpd24-nghttp2-0:1.43.0-13.el8jbcs

Fixed · RHSA-2024:2693
JBoss Core Services on RHEL 7

jbcs-httpd24-curl-0:8.7.1-2.el7jbcs

Fixed · RHSA-2024:2693
JBoss Core Services on RHEL 7

jbcs-httpd24-httpd-0:2.4.57-10.el7jbcs

Fixed · RHSA-2024:2693
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_http2-0:1.15.19-37.el7jbcs

Fixed · RHSA-2024:2693
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_jk-0:1.2.49-6.redhat_1.el7jbcs

Fixed · RHSA-2024:2693
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_md-1:2.4.24-6.el7jbcs

Fixed · RHSA-2024:2693
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_proxy_cluster-0:1.3.20-4.el7jbcs

Fixed · RHSA-2024:2693
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_security-0:2.9.3-36.el7jbcs

Fixed · RHSA-2024:2693
JBoss Core Services on RHEL 7

jbcs-httpd24-nghttp2-0:1.43.0-13.el7jbcs

Fixed · RHSA-2024:2693
Red Hat Enterprise Linux 10

curl

Not affected
Red Hat Enterprise Linux 6

curl

Not affected
Red Hat Enterprise Linux 7

curl

Not affected
Red Hat Enterprise Linux 8

curl

Not affected
Red Hat Enterprise Linux 9

curl

Not affected
Red Hat Software Collections

httpd24-curl

Not affected

Product	Package	State	Advisory
JBoss Core Services for RHEL 8	jbcs-httpd24-curl-0:8.7.1-2.el8jbcs	Fixed	RHSA-2024:2693
JBoss Core Services for RHEL 8	jbcs-httpd24-httpd-0:2.4.57-10.el8jbcs	Fixed	RHSA-2024:2693
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_http2-0:1.15.19-37.el8jbcs	Fixed	RHSA-2024:2693
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_jk-0:1.2.49-6.redhat_1.el8jbcs	Fixed	RHSA-2024:2693
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_md-1:2.4.24-6.el8jbcs	Fixed	RHSA-2024:2693
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_proxy_cluster-0:1.3.20-4.el8jbcs	Fixed	RHSA-2024:2693
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_security-0:2.9.3-36.el8jbcs	Fixed	RHSA-2024:2693
JBoss Core Services for RHEL 8	jbcs-httpd24-nghttp2-0:1.43.0-13.el8jbcs	Fixed	RHSA-2024:2693
JBoss Core Services on RHEL 7	jbcs-httpd24-curl-0:8.7.1-2.el7jbcs	Fixed	RHSA-2024:2693
JBoss Core Services on RHEL 7	jbcs-httpd24-httpd-0:2.4.57-10.el7jbcs	Fixed	RHSA-2024:2693
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_http2-0:1.15.19-37.el7jbcs	Fixed	RHSA-2024:2693
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_jk-0:1.2.49-6.redhat_1.el7jbcs	Fixed	RHSA-2024:2693
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_md-1:2.4.24-6.el7jbcs	Fixed	RHSA-2024:2693
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_proxy_cluster-0:1.3.20-4.el7jbcs	Fixed	RHSA-2024:2693
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_security-0:2.9.3-36.el7jbcs	Fixed	RHSA-2024:2693
JBoss Core Services on RHEL 7	jbcs-httpd24-nghttp2-0:1.43.0-13.el7jbcs	Fixed	RHSA-2024:2693
Red Hat Enterprise Linux 10	curl	Not affected	n/a
Red Hat Enterprise Linux 6	curl	Not affected	n/a
Red Hat Enterprise Linux 7	curl	Not affected	n/a
Red Hat Enterprise Linux 8	curl	Not affected	n/a
Red Hat Enterprise Linux 9	curl	Not affected	n/a
Red Hat Software Collections	httpd24-curl	Not affected	n/a

Remediation

Red Hat statement

The curl package as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and RHSCL is not affected by this vulnerability because the vulnerable code was introduced in a newer version of curl.

Metrics

1.68% 0.01681

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01681

Score over time

2024–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.68% (0.01681)	76.10th	v5 (v2026.06.15)
Jun 15, 2026	1.68% (0.01681)	73.87th	v5 (v2026.06.15)
Jun 1, 2025	0.46% (0.00465)	63.43th	v4 (v2025.03.14)
Mar 30, 2025	1.47% (0.01471)	79.14th	v4 (v2025.03.14)
Mar 29, 2025	2.84% (0.02837)	76.99th	v4 (v2025.03.14)
Mar 17, 2025	1.47% (0.01471)	79.60th	v4 (v2025.03.14)
Dec 12, 2024	0.05% (0.00046)	19.10th	v3 (v2023.03.01)
May 2, 2024	0.04% (0.00044)	9.54th	v3 (v2023.03.01)
Mar 27, 2024	0.04% (0.00045)	13.12th	v3 (v2023.03.01)

Weaknesses (2)

CWE-115

CWE-436

References (17)

http://seclists.org/fulldisclosure/2024/Jul/18
Mailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/19
Mailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/20
Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2024/03/27/1
Mailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2024-2004
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2270500
Issue Tracking
https://curl.se/docs/CVE-2024-2004.html
Vendor Advisory
https://curl.se/docs/CVE-2024-2004.json
Vendor Advisory
https://hackerone.com/reports/2384833
ExploitIssue TrackingThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/
Third Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-2004
https://security.netapp.com/advisory/ntap-20240524-0006/
Third Party Advisory
https://support.apple.com/kb/HT214118
Release NotesVendor Advisory
https://support.apple.com/kb/HT214119
Release NotesVendor Advisory
https://support.apple.com/kb/HT214120
Release NotesVendor Advisory
https://www.cve.org/CVERecord?id=CVE-2024-2004

Link	Providers	Tags
http://seclists.org/fulldisclosure/2024/Jul/18		Mailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/19		Mailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/20		Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2024/03/27/1		Mailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2024-2004		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2270500		Issue Tracking
https://curl.se/docs/CVE-2024-2004.html		Vendor Advisory
https://curl.se/docs/CVE-2024-2004.json		Vendor Advisory
https://hackerone.com/reports/2384833		ExploitIssue TrackingThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/		Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/		Third Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-2004
https://security.netapp.com/advisory/ntap-20240524-0006/		Third Party Advisory
https://support.apple.com/kb/HT214118		Release NotesVendor Advisory
https://support.apple.com/kb/HT214119		Release NotesVendor Advisory
https://support.apple.com/kb/HT214120		Release NotesVendor Advisory
https://www.cve.org/CVERecord?id=CVE-2024-2004