CVE-2024-2004
When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error…
Published Mar 27, 2024 · updated Oct 15, 2026 · haxx curl
When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.
Timeline
Detection, updates, and resolution for this record.
Mar 27, 2024 · NIST NVD
Detected
When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of sel
Oct 15, 2026 · NIST NVD
Updated
When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of sel
Affected
- cpe apple/macosversion unspecified
- cpe fedoraproject/fedora39
- cpe fedoraproject/fedora40
- cpe haxx/curlversion unspecified
- cpe netapp/bootstrap osversion unspecified
- cpe netapp/h300s firmwareversion unspecified
- cpe netapp/h410s firmwareversion unspecified
- cpe netapp/h500s firmwareversion unspecified
- cpe netapp/ontap9
- cpe netapp/ontap select deploy administration utilityversion unspecified
Sources
- CVE.orgCVE-2024-2004
Official CVE identifier
cve.org - NIST NVDCVE-2024-2004
When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protoc
nvd.nist.gov