CVE-2024-2379
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL.
Published Mar 27, 2024 · updated Oct 15, 2026 · haxx curl
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
Timeline
Detection, updates, and resolution for this record.
Mar 27, 2024 · NIST NVD
Detected
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
Oct 15, 2026 · NIST NVD
Updated
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
Affected
- cpe apple/macosversion unspecified
- cpe haxx/curl8.6.0
- cpe netapp/active iq unified managerversion unspecified
- cpe netapp/h300s firmwareversion unspecified
- cpe netapp/h410s firmwareversion unspecified
- cpe netapp/h500s firmwareversion unspecified
- cpe netapp/h610c firmwareversion unspecified
- cpe netapp/h610s firmwareversion unspecified
- cpe netapp/h615c firmwareversion unspecified
- cpe netapp/ontap select deploy administration utilityversion unspecified
Sources
- CVE.orgCVE-2024-2379
Official CVE identifier
cve.org - NIST NVDCVE-2024-2379
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
nvd.nist.gov