{
  "schema_version": "1.5.0",
  "id": "CURL-CVE-2024-2398",
  "aliases": [
    "CVE-2024-2398"
  ],
  "summary": "HTTP/2 push headers memory-leak",
  "modified": "2026-04-25T17:48:46.00Z",
  "database_specific": {
    "package": "curl",
    "affects": "lib",
    "URL": "https://curl.se/docs/CVE-2024-2398.json",
    "www": "https://curl.se/docs/CVE-2024-2398.html",
    "issue": "https://hackerone.com/reports/2402845",
    "CWE": {
      "id": "CWE-772",
      "desc": "Missing Release of Resource after Effective Lifetime"
    },
    "award": {
      "amount": "2540",
      "currency": "USD"
    },
    "last_affected": "8.6.0",
    "severity": "Medium"
  },
  "published": "2024-03-27T08:00:00.00Z",
  "affected": [
    {
      "ranges": [
        {
           "type": "SEMVER",
           "events": [
             {"introduced": "7.44.0"},
             {"fixed": "8.7.0"}
           ]
        },
        {
           "type": "GIT",
           "repo": "https://github.com/curl/curl.git",
           "events": [
             {"introduced": "ea7134ac874a66107e54ff93657ac565cf2ec4aa"},
             {"fixed": "deca8039991886a559b67bcd6701db800a5cf764"}
           ]
        }
      ],
      "versions": [
        "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", 
        "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", 
        "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", 
        "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", 
        "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", 
        "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", 
        "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", 
        "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", 
        "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", 
        "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", 
        "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0"
      ]
    }
  ],
  "credits": [
    {
      "name": "w0x42 on hackerone",
      "type": "FINDER"
    },
    {
      "name": "Stefan Eissing",
      "type": "REMEDIATION_DEVELOPER"
    }
  ],
  "details": "When an application tells libcurl it wants to allow HTTP/2 server push, and\nthe amount of received headers for the push surpasses the maximum allowed\nlimit (1000), libcurl aborts the server push. When aborting, libcurl\ninadvertently does not free all the previously allocated headers and instead\nleaks the memory.\n\nFurther, this error condition fails silently and is therefore not easily\ndetected by an application."
}