CVE-2024-2398 — HTTP/2 push headers memory-leak

Back Back to CVE browser

HIGH

HTTP/2 push headers memory-leak

Published Mar 27, 2024

8.6

HIGH

CVSS 3.1

EPSS 36.08%

Description

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.

Affected products

Vendor Curl Product Curl Default
unaffected
- Version
  7.44.0
  Status
  affected
  Constraints
  <=7.44.0
- Version
  7.45.0
  Status
  affected
  Constraints
  <=7.45.0
- Version
  7.46.0
  Status
  affected
  Constraints
  <=7.46.0
- Version
  7.47.0
  Status
  affected
  Constraints
  <=7.47.0
- Version
  7.47.1
  Status
  affected
  Constraints
  <=7.47.1
- Version
  7.48.0
  Status
  affected
  Constraints
  <=7.48.0
- Version
  7.49.0
  Status
  affected
  Constraints
  <=7.49.0
- Version
  7.49.1
  Status
  affected
  Constraints
  <=7.49.1
- Version
  7.50.0
  Status
  affected
  Constraints
  <=7.50.0
- Version
  7.50.1
  Status
  affected
  Constraints
  <=7.50.1
- Version
  7.50.2
  Status
  affected
  Constraints
  <=7.50.2
- Version
  7.50.3
  Status
  affected
  Constraints
  <=7.50.3
- Version
  7.51.0
  Status
  affected
  Constraints
  <=7.51.0
- Version
  7.52.0
  Status
  affected
  Constraints
  <=7.52.0
- Version
  7.52.1
  Status
  affected
  Constraints
  <=7.52.1
- Version
  7.53.0
  Status
  affected
  Constraints
  <=7.53.0
- Version
  7.53.1
  Status
  affected
  Constraints
  <=7.53.1
- Version
  7.54.0
  Status
  affected
  Constraints
  <=7.54.0
- Version
  7.54.1
  Status
  affected
  Constraints
  <=7.54.1
- Version
  7.55.0
  Status
  affected
  Constraints
  <=7.55.0
- Version
  7.55.1
  Status
  affected
  Constraints
  <=7.55.1
- Version
  7.56.0
  Status
  affected
  Constraints
  <=7.56.0
- Version
  7.56.1
  Status
  affected
  Constraints
  <=7.56.1
- Version
  7.57.0
  Status
  affected
  Constraints
  <=7.57.0
- Version
  7.58.0
  Status
  affected
  Constraints
  <=7.58.0
- Version
  7.59.0
  Status
  affected
  Constraints
  <=7.59.0
- Version
  7.60.0
  Status
  affected
  Constraints
  <=7.60.0
- Version
  7.61.0
  Status
  affected
  Constraints
  <=7.61.0
- Version
  7.61.1
  Status
  affected
  Constraints
  <=7.61.1
- Version
  7.62.0
  Status
  affected
  Constraints
  <=7.62.0
- Version
  7.63.0
  Status
  affected
  Constraints
  <=7.63.0
- Version
  7.64.0
  Status
  affected
  Constraints
  <=7.64.0
- Version
  7.64.1
  Status
  affected
  Constraints
  <=7.64.1
- Version
  7.65.0
  Status
  affected
  Constraints
  <=7.65.0
- Version
  7.65.1
  Status
  affected
  Constraints
  <=7.65.1
- Version
  7.65.2
  Status
  affected
  Constraints
  <=7.65.2
- Version
  7.65.3
  Status
  affected
  Constraints
  <=7.65.3
- Version
  7.66.0
  Status
  affected
  Constraints
  <=7.66.0
- Version
  7.67.0
  Status
  affected
  Constraints
  <=7.67.0
- Version
  7.68.0
  Status
  affected
  Constraints
  <=7.68.0
- Version
  7.69.0
  Status
  affected
  Constraints
  <=7.69.0
- Version
  7.69.1
  Status
  affected
  Constraints
  <=7.69.1
- Version
  7.70.0
  Status
  affected
  Constraints
  <=7.70.0
- Version
  7.71.0
  Status
  affected
  Constraints
  <=7.71.0
- Version
  7.71.1
  Status
  affected
  Constraints
  <=7.71.1
- Version
  7.72.0
  Status
  affected
  Constraints
  <=7.72.0
- Version
  7.73.0
  Status
  affected
  Constraints
  <=7.73.0
- Version
  7.74.0
  Status
  affected
  Constraints
  <=7.74.0
- Version
  7.75.0
  Status
  affected
  Constraints
  <=7.75.0
- Version
  7.76.0
  Status
  affected
  Constraints
  <=7.76.0
- Version
  7.76.1
  Status
  affected
  Constraints
  <=7.76.1
- Version
  7.77.0
  Status
  affected
  Constraints
  <=7.77.0
- Version
  7.78.0
  Status
  affected
  Constraints
  <=7.78.0
- Version
  7.79.0
  Status
  affected
  Constraints
  <=7.79.0
- Version
  7.79.1
  Status
  affected
  Constraints
  <=7.79.1
- Version
  7.80.0
  Status
  affected
  Constraints
  <=7.80.0
- Version
  7.81.0
  Status
  affected
  Constraints
  <=7.81.0
- Version
  7.82.0
  Status
  affected
  Constraints
  <=7.82.0
- Version
  7.83.0
  Status
  affected
  Constraints
  <=7.83.0
- Version
  7.83.1
  Status
  affected
  Constraints
  <=7.83.1
- Version
  7.84.0
  Status
  affected
  Constraints
  <=7.84.0
- Version
  7.85.0
  Status
  affected
  Constraints
  <=7.85.0
- Version
  7.86.0
  Status
  affected
  Constraints
  <=7.86.0
- Version
  7.87.0
  Status
  affected
  Constraints
  <=7.87.0
- Version
  7.88.0
  Status
  affected
  Constraints
  <=7.88.0
- Version
  7.88.1
  Status
  affected
  Constraints
  <=7.88.1
- Version
  8.0.0
  Status
  affected
  Constraints
  <=8.0.0
- Version
  8.0.1
  Status
  affected
  Constraints
  <=8.0.1
- Version
  8.1.0
  Status
  affected
  Constraints
  <=8.1.0
- Version
  8.1.1
  Status
  affected
  Constraints
  <=8.1.1
- Version
  8.1.2
  Status
  affected
  Constraints
  <=8.1.2
- Version
  8.2.0
  Status
  affected
  Constraints
  <=8.2.0
- Version
  8.2.1
  Status
  affected
  Constraints
  <=8.2.1
- Version
  8.3.0
  Status
  affected
  Constraints
  <=8.3.0
- Version
  8.4.0
  Status
  affected
  Constraints
  <=8.4.0
- Version
  8.5.0
  Status
  affected
  Constraints
  <=8.5.0
- Version
  8.6.0
  Status
  affected
  Constraints
  <=8.6.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Curl

unaffected

Version	Status	Constraints
7.44.0	affected	<=7.44.0
7.45.0	affected	<=7.45.0
7.46.0	affected	<=7.46.0
7.47.0	affected	<=7.47.0
7.47.1	affected	<=7.47.1
7.48.0	affected	<=7.48.0
7.49.0	affected	<=7.49.0
7.49.1	affected	<=7.49.1
7.50.0	affected	<=7.50.0
7.50.1	affected	<=7.50.1
7.50.2	affected	<=7.50.2
7.50.3	affected	<=7.50.3
7.51.0	affected	<=7.51.0
7.52.0	affected	<=7.52.0
7.52.1	affected	<=7.52.1
7.53.0	affected	<=7.53.0
7.53.1	affected	<=7.53.1
7.54.0	affected	<=7.54.0
7.54.1	affected	<=7.54.1
7.55.0	affected	<=7.55.0
7.55.1	affected	<=7.55.1
7.56.0	affected	<=7.56.0
7.56.1	affected	<=7.56.1
7.57.0	affected	<=7.57.0
7.58.0	affected	<=7.58.0
7.59.0	affected	<=7.59.0
7.60.0	affected	<=7.60.0
7.61.0	affected	<=7.61.0
7.61.1	affected	<=7.61.1
7.62.0	affected	<=7.62.0
7.63.0	affected	<=7.63.0
7.64.0	affected	<=7.64.0
7.64.1	affected	<=7.64.1
7.65.0	affected	<=7.65.0
7.65.1	affected	<=7.65.1
7.65.2	affected	<=7.65.2
7.65.3	affected	<=7.65.3
7.66.0	affected	<=7.66.0
7.67.0	affected	<=7.67.0
7.68.0	affected	<=7.68.0
7.69.0	affected	<=7.69.0
7.69.1	affected	<=7.69.1
7.70.0	affected	<=7.70.0
7.71.0	affected	<=7.71.0
7.71.1	affected	<=7.71.1
7.72.0	affected	<=7.72.0
7.73.0	affected	<=7.73.0
7.74.0	affected	<=7.74.0
7.75.0	affected	<=7.75.0
7.76.0	affected	<=7.76.0
7.76.1	affected	<=7.76.1
7.77.0	affected	<=7.77.0
7.78.0	affected	<=7.78.0
7.79.0	affected	<=7.79.0
7.79.1	affected	<=7.79.1
7.80.0	affected	<=7.80.0
7.81.0	affected	<=7.81.0
7.82.0	affected	<=7.82.0
7.83.0	affected	<=7.83.0
7.83.1	affected	<=7.83.1
7.84.0	affected	<=7.84.0
7.85.0	affected	<=7.85.0
7.86.0	affected	<=7.86.0
7.87.0	affected	<=7.87.0
7.88.0	affected	<=7.88.0
7.88.1	affected	<=7.88.1
8.0.0	affected	<=8.0.0
8.0.1	affected	<=8.0.1
8.1.0	affected	<=8.1.0
8.1.1	affected	<=8.1.1
8.1.2	affected	<=8.1.2
8.2.0	affected	<=8.2.0
8.2.1	affected	<=8.2.1
8.3.0	affected	<=8.3.0
8.4.0	affected	<=8.4.0
8.5.0	affected	<=8.5.0
8.6.0	affected	<=8.6.0

Vendor Curl Product Curl Default
n/a
- Version
  7.44.0
  Status
  affected
  Constraints
  <=8.6.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Curl

n/a

Version	Status	Constraints
7.44.0	affected	<=8.6.0

JBoss Core Services for RHEL 8

jbcs-httpd24-curl-0:8.7.1-2.el8jbcs

Fixed · RHSA-2024:2693
JBoss Core Services for RHEL 8

jbcs-httpd24-httpd-0:2.4.57-10.el8jbcs

Fixed · RHSA-2024:2693
JBoss Core Services for RHEL 8

jbcs-httpd24-mod_http2-0:1.15.19-37.el8jbcs

Fixed · RHSA-2024:2693
JBoss Core Services for RHEL 8

jbcs-httpd24-mod_jk-0:1.2.49-6.redhat_1.el8jbcs

Fixed · RHSA-2024:2693
JBoss Core Services for RHEL 8

jbcs-httpd24-mod_md-1:2.4.24-6.el8jbcs

Fixed · RHSA-2024:2693
JBoss Core Services for RHEL 8

jbcs-httpd24-mod_proxy_cluster-0:1.3.20-4.el8jbcs

Fixed · RHSA-2024:2693
JBoss Core Services for RHEL 8

jbcs-httpd24-mod_security-0:2.9.3-36.el8jbcs

Fixed · RHSA-2024:2693
JBoss Core Services for RHEL 8

jbcs-httpd24-nghttp2-0:1.43.0-13.el8jbcs

Fixed · RHSA-2024:2693
JBoss Core Services on RHEL 7

jbcs-httpd24-curl-0:8.7.1-2.el7jbcs

Fixed · RHSA-2024:2693
JBoss Core Services on RHEL 7

jbcs-httpd24-httpd-0:2.4.57-10.el7jbcs

Fixed · RHSA-2024:2693
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_http2-0:1.15.19-37.el7jbcs

Fixed · RHSA-2024:2693
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_jk-0:1.2.49-6.redhat_1.el7jbcs

Fixed · RHSA-2024:2693
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_md-1:2.4.24-6.el7jbcs

Fixed · RHSA-2024:2693
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_proxy_cluster-0:1.3.20-4.el7jbcs

Fixed · RHSA-2024:2693
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_security-0:2.9.3-36.el7jbcs

Fixed · RHSA-2024:2693
JBoss Core Services on RHEL 7

jbcs-httpd24-nghttp2-0:1.43.0-13.el7jbcs

Fixed · RHSA-2024:2693
Red Hat Enterprise Linux 8

curl-0:7.61.1-34.el8_10.2

Fixed · RHSA-2024:5654
Red Hat Enterprise Linux 9

curl-0:7.76.1-29.el9_4.1

Fixed · RHSA-2024:5529
Red Hat Enterprise Linux 9

curl-0:7.76.1-29.el9_4.1

Fixed · RHSA-2024:5529
Red Hat Enterprise Linux 9.2 Extended Update Support

curl-0:7.76.1-23.el9_2.7

Fixed · RHSA-2024:3998
Service Interconnect 1 for RHEL 9

service-interconnect/skupper-config-sync-rhel9:1.5.5-3

Fixed · RHSA-2024:7374
Service Interconnect 1 for RHEL 9

service-interconnect/skupper-config-sync-rhel9:1.5.5-4

Fixed · RHSA-2024:11109
Service Interconnect 1 for RHEL 9

service-interconnect/skupper-controller-podman-container-rhel9:1.5.5-3

Fixed · RHSA-2024:7374
Service Interconnect 1 for RHEL 9

service-interconnect/skupper-controller-podman-container-rhel9:1.5.5-4

Fixed · RHSA-2024:11109
Service Interconnect 1 for RHEL 9

service-interconnect/skupper-controller-podman-rhel9:1.5.5-3

Fixed · RHSA-2024:7374
Service Interconnect 1 for RHEL 9

service-interconnect/skupper-controller-podman-rhel9:1.5.5-4

Fixed · RHSA-2024:11109
Service Interconnect 1 for RHEL 9

service-interconnect/skupper-flow-collector-rhel9:1.5.5-3

Fixed · RHSA-2024:7374
Service Interconnect 1 for RHEL 9

service-interconnect/skupper-flow-collector-rhel9:1.5.5-4

Fixed · RHSA-2024:11109
Service Interconnect 1 for RHEL 9

service-interconnect/skupper-operator-bundle:1.5.5-3

Fixed · RHSA-2024:7374
Service Interconnect 1 for RHEL 9

service-interconnect/skupper-operator-bundle:1.5.5-4

Fixed · RHSA-2024:11109
Service Interconnect 1 for RHEL 9

service-interconnect/skupper-router-rhel9:2.5.3-5

Fixed · RHSA-2024:7374
Service Interconnect 1 for RHEL 9

service-interconnect/skupper-router-rhel9:2.5.3-6

Fixed · RHSA-2024:11109
Service Interconnect 1 for RHEL 9

service-interconnect/skupper-service-controller-rhel9:1.5.5-3

Fixed · RHSA-2024:7374
Service Interconnect 1 for RHEL 9

service-interconnect/skupper-service-controller-rhel9:1.5.5-4

Fixed · RHSA-2024:11109
Service Interconnect 1 for RHEL 9

service-interconnect/skupper-site-controller-rhel9:1.5.5-3

Fixed · RHSA-2024:7374
Service Interconnect 1 for RHEL 9

service-interconnect/skupper-site-controller-rhel9:1.5.5-4

Fixed · RHSA-2024:11109
Service Interconnect 1.4 for RHEL 9

service-interconnect/skupper-config-sync-rhel9:1.4.7-2

Fixed · RHSA-2024:7213
Service Interconnect 1.4 for RHEL 9

service-interconnect/skupper-config-sync-rhel9:1.4.7-3

Fixed · RHSA-2024:10135
Service Interconnect 1.4 for RHEL 9

service-interconnect/skupper-flow-collector-rhel9:1.4.7-2

Fixed · RHSA-2024:7213
Service Interconnect 1.4 for RHEL 9

service-interconnect/skupper-flow-collector-rhel9:1.4.7-3

Fixed · RHSA-2024:10135
Service Interconnect 1.4 for RHEL 9

service-interconnect/skupper-operator-bundle:1.4.7-2

Fixed · RHSA-2024:7213
Service Interconnect 1.4 for RHEL 9

service-interconnect/skupper-operator-bundle:1.4.7-4

Fixed · RHSA-2024:10135
Service Interconnect 1.4 for RHEL 9

service-interconnect/skupper-router-rhel9:2.4.3-6

Fixed · RHSA-2024:7213
Service Interconnect 1.4 for RHEL 9

service-interconnect/skupper-router-rhel9:2.4.3-7

Fixed · RHSA-2024:10135
Service Interconnect 1.4 for RHEL 9

service-interconnect/skupper-service-controller-rhel9:1.4.7-2

Fixed · RHSA-2024:7213
Service Interconnect 1.4 for RHEL 9

service-interconnect/skupper-service-controller-rhel9:1.4.7-3

Fixed · RHSA-2024:10135
Service Interconnect 1.4 for RHEL 9

service-interconnect/skupper-site-controller-rhel9:1.4.7-2

Fixed · RHSA-2024:7213
Service Interconnect 1.4 for RHEL 9

service-interconnect/skupper-site-controller-rhel9:1.4.7-3

Fixed · RHSA-2024:10135
Red Hat Enterprise Linux 10

curl

Not affected
Red Hat Enterprise Linux 6

curl

Out of support scope
Red Hat Enterprise Linux 7

curl

Out of support scope
Red Hat Software Collections

httpd24-curl

Will not fix

Product	Package	State	Advisory
JBoss Core Services for RHEL 8	jbcs-httpd24-curl-0:8.7.1-2.el8jbcs	Fixed	RHSA-2024:2693
JBoss Core Services for RHEL 8	jbcs-httpd24-httpd-0:2.4.57-10.el8jbcs	Fixed	RHSA-2024:2693
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_http2-0:1.15.19-37.el8jbcs	Fixed	RHSA-2024:2693
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_jk-0:1.2.49-6.redhat_1.el8jbcs	Fixed	RHSA-2024:2693
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_md-1:2.4.24-6.el8jbcs	Fixed	RHSA-2024:2693
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_proxy_cluster-0:1.3.20-4.el8jbcs	Fixed	RHSA-2024:2693
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_security-0:2.9.3-36.el8jbcs	Fixed	RHSA-2024:2693
JBoss Core Services for RHEL 8	jbcs-httpd24-nghttp2-0:1.43.0-13.el8jbcs	Fixed	RHSA-2024:2693
JBoss Core Services on RHEL 7	jbcs-httpd24-curl-0:8.7.1-2.el7jbcs	Fixed	RHSA-2024:2693
JBoss Core Services on RHEL 7	jbcs-httpd24-httpd-0:2.4.57-10.el7jbcs	Fixed	RHSA-2024:2693
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_http2-0:1.15.19-37.el7jbcs	Fixed	RHSA-2024:2693
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_jk-0:1.2.49-6.redhat_1.el7jbcs	Fixed	RHSA-2024:2693
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_md-1:2.4.24-6.el7jbcs	Fixed	RHSA-2024:2693
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_proxy_cluster-0:1.3.20-4.el7jbcs	Fixed	RHSA-2024:2693
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_security-0:2.9.3-36.el7jbcs	Fixed	RHSA-2024:2693
JBoss Core Services on RHEL 7	jbcs-httpd24-nghttp2-0:1.43.0-13.el7jbcs	Fixed	RHSA-2024:2693
Red Hat Enterprise Linux 8	curl-0:7.61.1-34.el8_10.2	Fixed	RHSA-2024:5654
Red Hat Enterprise Linux 9	curl-0:7.76.1-29.el9_4.1	Fixed	RHSA-2024:5529
Red Hat Enterprise Linux 9	curl-0:7.76.1-29.el9_4.1	Fixed	RHSA-2024:5529
Red Hat Enterprise Linux 9.2 Extended Update Support	curl-0:7.76.1-23.el9_2.7	Fixed	RHSA-2024:3998
Service Interconnect 1 for RHEL 9	service-interconnect/skupper-config-sync-rhel9:1.5.5-3	Fixed	RHSA-2024:7374
Service Interconnect 1 for RHEL 9	service-interconnect/skupper-config-sync-rhel9:1.5.5-4	Fixed	RHSA-2024:11109
Service Interconnect 1 for RHEL 9	service-interconnect/skupper-controller-podman-container-rhel9:1.5.5-3	Fixed	RHSA-2024:7374
Service Interconnect 1 for RHEL 9	service-interconnect/skupper-controller-podman-container-rhel9:1.5.5-4	Fixed	RHSA-2024:11109
Service Interconnect 1 for RHEL 9	service-interconnect/skupper-controller-podman-rhel9:1.5.5-3	Fixed	RHSA-2024:7374
Service Interconnect 1 for RHEL 9	service-interconnect/skupper-controller-podman-rhel9:1.5.5-4	Fixed	RHSA-2024:11109
Service Interconnect 1 for RHEL 9	service-interconnect/skupper-flow-collector-rhel9:1.5.5-3	Fixed	RHSA-2024:7374
Service Interconnect 1 for RHEL 9	service-interconnect/skupper-flow-collector-rhel9:1.5.5-4	Fixed	RHSA-2024:11109
Service Interconnect 1 for RHEL 9	service-interconnect/skupper-operator-bundle:1.5.5-3	Fixed	RHSA-2024:7374
Service Interconnect 1 for RHEL 9	service-interconnect/skupper-operator-bundle:1.5.5-4	Fixed	RHSA-2024:11109
Service Interconnect 1 for RHEL 9	service-interconnect/skupper-router-rhel9:2.5.3-5	Fixed	RHSA-2024:7374
Service Interconnect 1 for RHEL 9	service-interconnect/skupper-router-rhel9:2.5.3-6	Fixed	RHSA-2024:11109
Service Interconnect 1 for RHEL 9	service-interconnect/skupper-service-controller-rhel9:1.5.5-3	Fixed	RHSA-2024:7374
Service Interconnect 1 for RHEL 9	service-interconnect/skupper-service-controller-rhel9:1.5.5-4	Fixed	RHSA-2024:11109
Service Interconnect 1 for RHEL 9	service-interconnect/skupper-site-controller-rhel9:1.5.5-3	Fixed	RHSA-2024:7374
Service Interconnect 1 for RHEL 9	service-interconnect/skupper-site-controller-rhel9:1.5.5-4	Fixed	RHSA-2024:11109
Service Interconnect 1.4 for RHEL 9	service-interconnect/skupper-config-sync-rhel9:1.4.7-2	Fixed	RHSA-2024:7213
Service Interconnect 1.4 for RHEL 9	service-interconnect/skupper-config-sync-rhel9:1.4.7-3	Fixed	RHSA-2024:10135
Service Interconnect 1.4 for RHEL 9	service-interconnect/skupper-flow-collector-rhel9:1.4.7-2	Fixed	RHSA-2024:7213
Service Interconnect 1.4 for RHEL 9	service-interconnect/skupper-flow-collector-rhel9:1.4.7-3	Fixed	RHSA-2024:10135
Service Interconnect 1.4 for RHEL 9	service-interconnect/skupper-operator-bundle:1.4.7-2	Fixed	RHSA-2024:7213
Service Interconnect 1.4 for RHEL 9	service-interconnect/skupper-operator-bundle:1.4.7-4	Fixed	RHSA-2024:10135
Service Interconnect 1.4 for RHEL 9	service-interconnect/skupper-router-rhel9:2.4.3-6	Fixed	RHSA-2024:7213
Service Interconnect 1.4 for RHEL 9	service-interconnect/skupper-router-rhel9:2.4.3-7	Fixed	RHSA-2024:10135
Service Interconnect 1.4 for RHEL 9	service-interconnect/skupper-service-controller-rhel9:1.4.7-2	Fixed	RHSA-2024:7213
Service Interconnect 1.4 for RHEL 9	service-interconnect/skupper-service-controller-rhel9:1.4.7-3	Fixed	RHSA-2024:10135
Service Interconnect 1.4 for RHEL 9	service-interconnect/skupper-site-controller-rhel9:1.4.7-2	Fixed	RHSA-2024:7213
Service Interconnect 1.4 for RHEL 9	service-interconnect/skupper-site-controller-rhel9:1.4.7-3	Fixed	RHSA-2024:10135
Red Hat Enterprise Linux 10	curl	Not affected	n/a
Red Hat Enterprise Linux 6	curl	Out of support scope	n/a
Red Hat Enterprise Linux 7	curl	Out of support scope	n/a
Red Hat Software Collections	httpd24-curl	Will not fix	n/a

Remediation

No remediation recorded yet.

Metrics

36.08% 0.36081

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.36081

Score over time

2024–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (18 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	36.08% (0.36081)	98.43th	v5 (v2026.06.15)
Jun 15, 2026	36.08% (0.36081)	98.27th	v5 (v2026.06.15)
Nov 21, 2025	1.96% (0.01962)	82.96th	v4 (v2025.03.14)
Nov 18, 2025	5.42% (0.05420)	89.16th	v4 (v2025.03.14)
Jul 31, 2025	1.49% (0.01493)	80.30th	v4 (v2025.03.14)
Jul 4, 2025	2.90% (0.02895)	85.77th	v4 (v2025.03.14)
Jul 1, 2025	1.74% (0.01743)	81.73th	v4 (v2025.03.14)
Jun 4, 2025	2.90% (0.02895)	85.67th	v4 (v2025.03.14)
Jun 1, 2025	1.74% (0.01743)	81.64th	v4 (v2025.03.14)
May 4, 2025	3.69% (0.03694)	87.29th	v4 (v2025.03.14)
May 1, 2025	1.54% (0.01537)	80.39th	v4 (v2025.03.14)
Apr 15, 2025	3.69% (0.03694)	87.25th	v4 (v2025.03.14)
Mar 30, 2025	10.27% (0.10268)	92.43th	v4 (v2025.03.14)
Mar 29, 2025	17.93% (0.17926)	92.00th	v4 (v2025.03.14)
Mar 17, 2025	10.27% (0.10268)	92.59th	v4 (v2025.03.14)
Dec 12, 2024	0.05% (0.00046)	19.10th	v3 (v2023.03.01)
May 2, 2024	0.04% (0.00044)	9.54th	v3 (v2023.03.01)
Mar 27, 2024	0.04% (0.00045)	13.12th	v3 (v2023.03.01)

Weaknesses (1)

CWE-772

References (17)

http://seclists.org/fulldisclosure/2024/Jul/18
Mailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/19
Mailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/20
Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2024/03/27/3
Mailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2024-2398
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2270498
Issue Tracking
https://curl.se/docs/CVE-2024-2398.html
Vendor Advisory
https://curl.se/docs/CVE-2024-2398.json
Vendor Advisory
https://hackerone.com/reports/2402845
ExploitIssue TrackingThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/
Third Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-2398
https://security.netapp.com/advisory/ntap-20240503-0009/
Third Party Advisory
https://support.apple.com/kb/HT214118
Release NotesVendor Advisory
https://support.apple.com/kb/HT214119
Release NotesVendor Advisory
https://support.apple.com/kb/HT214120
Release NotesVendor Advisory
https://www.cve.org/CVERecord?id=CVE-2024-2398

Link	Providers	Tags
http://seclists.org/fulldisclosure/2024/Jul/18		Mailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/19		Mailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/20		Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2024/03/27/3		Mailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2024-2398		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2270498		Issue Tracking
https://curl.se/docs/CVE-2024-2398.html		Vendor Advisory
https://curl.se/docs/CVE-2024-2398.json		Vendor Advisory
https://hackerone.com/reports/2402845		ExploitIssue TrackingThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/		Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/		Third Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-2398
https://security.netapp.com/advisory/ntap-20240503-0009/		Third Party Advisory
https://support.apple.com/kb/HT214118		Release NotesVendor Advisory
https://support.apple.com/kb/HT214119		Release NotesVendor Advisory
https://support.apple.com/kb/HT214120		Release NotesVendor Advisory
https://www.cve.org/CVERecord?id=CVE-2024-2398