CVE-2024-2398
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), lib…
Published Mar 27, 2024 · updated Oct 15, 2026 · haxx curl
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.
Timeline
Detection, updates, and resolution for this record.
Mar 27, 2024 · NIST NVD
Detected
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by a
Oct 15, 2026 · NIST NVD
Updated
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by a
Affected
- cpe apple/macosversion unspecified
- cpe fedoraproject/fedora39
- cpe fedoraproject/fedora40
- cpe haxx/curlversion unspecified
- cpe netapp/active iq unified managerversion unspecified
- cpe netapp/bootstrap osversion unspecified
- cpe netapp/h300s firmwareversion unspecified
- cpe netapp/h410s firmwareversion unspecified
- cpe netapp/h500s firmwareversion unspecified
- cpe netapp/ontap select deploy administration utilityversion unspecified
Sources
- CVE.orgCVE-2024-2398
Official CVE identifier
cve.org - NIST NVDCVE-2024-2398
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated head
nvd.nist.gov