CVE-2024-2398

HighCVSS 8.6/10Last modified Oct 15, 2026

Description

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-772

Affected software

No affected versions have been published.

Timeline

Published: Mar 27, 2024
Last modified: Oct 15, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-239807.5Improper buffer restrictions in PlatformPfrDxe driver in UEFI firmware for some Intel(R) Server D50FCP Family products may allow a privilege CVE-2024-239818.8Wrap-around error in Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before version 28.3 may allow an a CVE-2024-239827.5When a BIG-IP PEM classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microk CVE-2024-239835.8Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.CVE-2024-239845.3Observable discrepancy in RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosu CVE-2024-239857.5EzServer 6.4.017 allows a denial of service (daemon crash) via a long string, such as one for the RNTO command.CVE-2024-23995.4The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions CVE-2024-239956.1Cross Site Scripting (XSS) in Beekeeper Studio 4.1.13 and earlier allows remote attackers to execute arbitrary code in the column name of a CVE-2024-239979.6Lukas Bach yana =<1.0.16 is vulnerable to Cross Site Scripting (XSS) via src/electron-main.ts.CVE-2024-239989.6goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.vue.CVE-2024-24008.8Use after free in Performance Manager in Google Chrome prior to 122.0.6261.128 allowed a remote attacker to potentially exploit heap corrupt CVE-2024-240009.8jshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and