CVE-2024-51979

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An authenticated attacker may trigger a stack based buffer overflow by performing a malformed request to either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631). The malformed request will contain an empty Origin header value and a malformed Referer header value. The Referer header value will trigger a stack based buffer overflow when the host value in the Referer header is processed and is greater than 64 bytes in length.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Jun 25, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-51983.3OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the driveCVE-2024-519805.3An unauthenticated attacker may perform a limited server side request forgery (SSRF), forcing the target device to open a TCP connection to CVE-2024-519815.3An unauthenticated attacker may perform a blind server side request forgery (SSRF), due to a CLRF injection issue that can be leveraged to pCVE-2024-519827.5An unauthenticated attacker who can connect to TCP port 9100 can issue a Printer Job Language (PJL) command that will crash the target devicCVE-2024-519837.5An unauthenticated attacker who can connect to the Web Services feature (HTTP TCP port 80) can issue a WS-Scan SOAP request containing an unCVE-2024-519846.8An authenticated attacker can reconfigure the target device to use an external service (such as LDAP or FTP) controlled by the attacker. If CVE-2024-519875.4Duende.AccessTokenManagement.OpenIdConnect is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. HTTP Clients creatCVE-2024-519886.5RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not veriCVE-2024-519897.1Password Pusher is an open source application to communicate sensitive information over the web. A cross-site scripting (XSS) vulnerability CVE-2024-51995.4The Spotify Play Button WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them baCVE-2024-519909.3jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write filCVE-2024-519914.9October is a Content Management System (CMS) and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrato
CVE-2024-51979: High severity, CVSS 7.2 | Vulnix