Memory Leak Vulnerability in libcurl Affects HTTP/2 Server Push

What changed

A vulnerability designated CVE-2024-2398 has been discovered in libcurl, specifically affecting its handling of HTTP/2 server push. When the number of received headers exceeds the predefined limit of 1000, libcurl aborts the server push process. However, during this abort, it fails to release all previously allocated memory for the headers, resulting in a memory leak.

This issue is particularly concerning as it fails silently, making it difficult for applications to detect the problem and potentially leading to increased memory consumption over time.

Who is affected

The vulnerability in libcurl could impact a variety of applications and services that rely on this library for HTTP/2 server push functionality. Organizations using affected versions of libcurl should be aware of the potential risks associated with this memory leak.

Developers integrating libcurl into their applications may also face challenges in identifying and mitigating the effects of this silent failure.

• Applications utilizing libcurl for HTTP/2 communications
• Developers and organizations relying on libcurl for web services
• Any services implementing server push features in their architecture

What to do

It is recommended that users of libcurl review their current implementations and assess whether they are affected by CVE-2024-2398. If so, they should consider updating to the latest version of libcurl where this issue may be addressed.

Additionally, monitoring memory usage and implementing logging can help detect potential leaks and mitigate the impact of this vulnerability.

• Upgrade to the latest version of libcurl as soon as possible.
• Implement monitoring for memory usage in applications using libcurl.
• Review application logs for any signs of silent failures related to server push.