Loading vulnerability…
libcurl HTTP/2 Push Headers Memory Leak
CVE-2024-2398 is a memory-leak vulnerability in libcurl's HTTP/2 server-push handling. When an application enables server push and a pushed response exceeds the 1,000-header limit, libcurl aborts the push without freeing all previously allocated header memory. A malicious server can repeatedly send excessive headers in PUSH_PROMISE frames to accumulate leaked memory. The error condition occurs silently, making application-level detection difficult, and repeated exploitation can cause resource exhaustion.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Repeated triggering can leak multiple megabytes of application memory per response, potentially exhausting available memory and causing denial of service in the consuming application. The silent failure can allow memory consumption to accumulate without an obvious application error. This memory leak does not itself establish disclosure of memory contents or arbitrary code execution.
If you can’t patch tonight, do this now.
Disable HTTP/2 server push in applications using libcurl to avoid the vulnerable code path until patched packages can be deployed.
Patch, then assume compromise.
Apply the upstream curl fix or install vendor-patched curl/libcurl packages for the affected product and release stream. Available fixes include Red Hat JBoss Core Services Apache HTTP Server 2.4.57 Service Pack 4, containing jbcs-httpd24-curl 8.7.1-2 for the applicable RHEL platform. Echo package updates include 7.69.1+e1 and 8.1.1+e1 for their respective package streams. For affected containerized products, deploy updated vendor images and rebuild dependent images. Account for vendor backports rather than relying exclusively on upstream version comparisons.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.