CVE-2024-2466
TLS certificate check bypass with mbedTLS
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
TLS certificate check bypass with mbedTLS
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
- Record
CVE-2024-2466- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-297
- Updated
- 2026-11-02
EUVDEUVD-2024-27415
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
- Record
EUVD-2024-27415- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9xr6-qf7m-2jv5
libcurl did not check the server certificate of TLS connections done to a host specified as an IP...
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
- Record
GHSA-9xr6-qf7m-2jv5- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-297
- Updated
- 2026-11-02
NVD
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
- Record
CVE-2024-2466- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-297
- Updated
- 2026-11-02
OSVALPINE-CVE-2024-2466
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
- Record
ALPINE-CVE-2024-2466- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVBELL-CVE-2024-2466
- Record
BELL-CVE-2024-2466- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Show 11 moreShow less
OSV
TLS certificate check bypass with mbedTLS
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
- Record
CVE-2024-2466- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-2466
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
- Record
DEBIAN-CVE-2024-2466- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVJLSEC-2026-417
libcurl did not check the server certificate of TLS connections done to a host specified as an IP...
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
- Record
JLSEC-2026-417- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2024:2693
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update
- Record
RHSA-2024:2693- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-37077 No score
CVE-2024-2466 affecting package curl for versions less than 8.8.0-1
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
- Record
AZL-37077- Updated
- 2026-11-02
OSVAZL-37103 No score
CVE-2024-2466 affecting package curl for versions less than 8.8.0-1
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
- Record
AZL-37103- Updated
- 2026-11-02
OSVAZL-42972 No score
CVE-2024-2466 affecting package cmake for versions less than 3.30.3-2
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
- Record
AZL-42972- Updated
- 2026-11-02
OSVCURL-CVE-2024-2466 No score
TLS certificate check bypass with mbedTLS
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.
libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
- Record
CURL-CVE-2024-2466- Updated
- 2026-11-02
OSVMGASA-2024-0099 No score
Updated curl packages fix security vulnerabilities
CVE-2024-2004: Usage of disabled protocol If all protocols are disabled at run-time with none being added, curl/libcurl would still allow communication with the default set of allowed protocols, including some that are unencrypted. CVE-2024-2398: HTTP/2 push headers memory-leak A memory leak could occur when an application enabled HTTP/2 server push and the server sent a large number of headers.
- Record
MGASA-2024-0099- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13805-1 No score
curl-8.7.1-1.1 on GA media
These are all security issues fixed in the curl-8.7.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13805-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:20029-1 No score
Security update for curl
This update for curl fixes the following issues:
Security issues fixed:
- CVE-2024-7264: ASN.1 date parser overread (bsc#1228535)
- CVE-2024-6197: Freeing stack buffer in utf8asn1str (bsc#1227888)
- CVE-2024-2379: QUIC certificate check bypass with wolfSSL (bsc#1221666)
- CVE-2024-2466: TLS certificate check bypass with mbedTLS (bsc#1221668)
- CVE-2024-2004: Usage of disabled protocol (bsc#1221665)
- CVE-2024-2398: HTTP/2 push headers memory-leak (bsc#1221667)
Non-security issue fixed:
- Fixed various TLS related issues including FTP over SSL transmission timeouts.
- Record
SUSE-SU-2025:20029-1- Updated
- 2026-11-02
Affected products
- curl
- curl libcurl
- haxx curl
- apple macos
- netapp bootstrap os
- netapp h300s firmware
- netapp h410s firmware
- netapp h500s firmware
- netapp h700s firmware
- siemens simatic s7-1500 cpu 1518-4 pn/dp mfp
- siemens simatic s7-1500 cpu 1518f-4 pn/dp mfp
- siemens sinec nms
Show 2 moreShow less
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlAlpine:v3.17 |
8.5.0 up to 8.7.1-r0 | 8.7.1-r0 |
curlAlpine:v3.18 |
8.5.0 up to 8.7.1-r0 | 8.7.1-r0 |
curlAlpine:v3.19 |
8.5.0 up to 8.7.1-r0 | 8.7.1-r0 |
curlAlpine:v3.20 |
8.5.0 up to 8.7.1-r0 | 8.7.1-r0 |
curlAlpine:v3.21 |
8.5.0 up to 8.7.1-r0 | 8.7.1-r0 |
curlAlpine:v3.22 |
8.5.0 up to 8.7.1-r0 | 8.7.1-r0 |
curlAlpine:v3.23 |
8.5.0 up to 8.7.1-r0 | 8.7.1-r0 |
curlAlpine:v3.24 |
8.5.0 up to 8.7.1-r0 | 8.7.1-r0 |
curlAzure Linux:2 |
before 8.8.0-1 | 8.8.0-1 |
curlAzure Linux:3 |
before 8.8.0-1 | 8.8.0-1 |
Show 73 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cmakeAzure Linux:3 |
before 3.30.3-2 | 3.30.3-2 |
curlAlpaquita:23 |
8.5.0-r0 up to 8.9.0-r0 | 8.9.0-r0 |
curlAlpaquita:stream |
8.5.0-r0 up to 8.7.1-r0 | 8.7.1-r0 |
curlBellSoft Hardened Containers:stream |
8.5.0-r0 up to 8.7.1-r0 | 8.7.1-r0 |
curlDebian:13 |
before 8.7.1-1 | 8.7.1-1 |
curlDebian:14 |
before 8.7.1-1 | 8.7.1-1 |
CURL_jllJulia |
8.5.0+0 up to 8.9.0+0 | 8.9.0+0 |
LibCURL_jllJulia |
8.5.0+0 up to 8.7.1+0 | 8.7.1+0 |
curlMageia:9 From an advisory covering 4 CVEs |
before 7.88.1-4.3.mga9 | 7.88.1-4.3.mga9 |
jbcs-httpd24-curlRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:8.7.1-2.el7jbcs | 0:8.7.1-2.el7jbcs |
jbcs-httpd24-curl-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:8.7.1-2.el7jbcs | 0:8.7.1-2.el7jbcs |
jbcs-httpd24-httpdRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el7jbcs | 0:2.4.57-10.el7jbcs |
jbcs-httpd24-httpd-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el7jbcs | 0:2.4.57-10.el7jbcs |
jbcs-httpd24-httpd-develRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el7jbcs | 0:2.4.57-10.el7jbcs |
jbcs-httpd24-httpd-manualRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el7jbcs | 0:2.4.57-10.el7jbcs |
jbcs-httpd24-httpd-selinuxRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el7jbcs | 0:2.4.57-10.el7jbcs |
jbcs-httpd24-httpd-toolsRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el7jbcs | 0:2.4.57-10.el7jbcs |
jbcs-httpd24-libcurlRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:8.7.1-2.el7jbcs | 0:8.7.1-2.el7jbcs |
jbcs-httpd24-libcurl-develRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:8.7.1-2.el7jbcs | 0:8.7.1-2.el7jbcs |
jbcs-httpd24-mod_http2Red Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.15.19-37.el7jbcs | 0:1.15.19-37.el7jbcs |
jbcs-httpd24-mod_http2-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.15.19-37.el7jbcs | 0:1.15.19-37.el7jbcs |
jbcs-httpd24-mod_jkRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.2.49-6.redhat_1.el7jbcs | 0:1.2.49-6.redhat_1.el7jbcs |
jbcs-httpd24-mod_jk-ap24Red Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.2.49-6.redhat_1.el7jbcs | 0:1.2.49-6.redhat_1.el7jbcs |
jbcs-httpd24-mod_jk-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.2.49-6.redhat_1.el7jbcs | 0:1.2.49-6.redhat_1.el7jbcs |
jbcs-httpd24-mod_ldapRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el7jbcs | 0:2.4.57-10.el7jbcs |
jbcs-httpd24-mod_mdRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 1:2.4.24-6.el7jbcs | 1:2.4.24-6.el7jbcs |
jbcs-httpd24-mod_md-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 1:2.4.24-6.el7jbcs | 1:2.4.24-6.el7jbcs |
jbcs-httpd24-mod_proxy_clusterRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.3.20-4.el7jbcs | 0:1.3.20-4.el7jbcs |
jbcs-httpd24-mod_proxy_cluster-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.3.20-4.el7jbcs | 0:1.3.20-4.el7jbcs |
jbcs-httpd24-mod_proxy_htmlRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 1:2.4.57-10.el7jbcs | 1:2.4.57-10.el7jbcs |
jbcs-httpd24-mod_securityRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.9.3-36.el7jbcs | 0:2.9.3-36.el7jbcs |
jbcs-httpd24-mod_security-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.9.3-36.el7jbcs | 0:2.9.3-36.el7jbcs |
jbcs-httpd24-mod_sessionRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el7jbcs | 0:2.4.57-10.el7jbcs |
jbcs-httpd24-mod_sslRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 1:2.4.57-10.el7jbcs | 1:2.4.57-10.el7jbcs |
jbcs-httpd24-nghttp2Red Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.43.0-13.el7jbcs | 0:1.43.0-13.el7jbcs |
jbcs-httpd24-nghttp2-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.43.0-13.el7jbcs | 0:1.43.0-13.el7jbcs |
jbcs-httpd24-nghttp2-develRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.43.0-13.el7jbcs | 0:1.43.0-13.el7jbcs |
jbcs-httpd24-curlRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:8.7.1-2.el8jbcs | 0:8.7.1-2.el8jbcs |
jbcs-httpd24-curl-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:8.7.1-2.el8jbcs | 0:8.7.1-2.el8jbcs |
jbcs-httpd24-httpdRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-httpd-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-httpd-develRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-httpd-manualRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-httpd-selinuxRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-httpd-toolsRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-httpd-tools-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-libcurlRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:8.7.1-2.el8jbcs | 0:8.7.1-2.el8jbcs |
jbcs-httpd24-libcurl-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:8.7.1-2.el8jbcs | 0:8.7.1-2.el8jbcs |
jbcs-httpd24-libcurl-develRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:8.7.1-2.el8jbcs | 0:8.7.1-2.el8jbcs |
jbcs-httpd24-mod_http2Red Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:1.15.19-37.el8jbcs | 0:1.15.19-37.el8jbcs |
jbcs-httpd24-mod_http2-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:1.15.19-37.el8jbcs | 0:1.15.19-37.el8jbcs |
jbcs-httpd24-mod_jkRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:1.2.49-6.redhat_1.el8jbcs | 0:1.2.49-6.redhat_1.el8jbcs |
jbcs-httpd24-mod_jk-ap24Red Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:1.2.49-6.redhat_1.el8jbcs | 0:1.2.49-6.redhat_1.el8jbcs |
jbcs-httpd24-mod_jk-ap24-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:1.2.49-6.redhat_1.el8jbcs | 0:1.2.49-6.redhat_1.el8jbcs |
jbcs-httpd24-mod_ldapRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-mod_ldap-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-mod_mdRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 1:2.4.24-6.el8jbcs | 1:2.4.24-6.el8jbcs |
jbcs-httpd24-mod_md-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 1:2.4.24-6.el8jbcs | 1:2.4.24-6.el8jbcs |
jbcs-httpd24-mod_proxy_clusterRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:1.3.20-4.el8jbcs | 0:1.3.20-4.el8jbcs |
jbcs-httpd24-mod_proxy_cluster-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:1.3.20-4.el8jbcs | 0:1.3.20-4.el8jbcs |
jbcs-httpd24-mod_proxy_htmlRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 1:2.4.57-10.el8jbcs | 1:2.4.57-10.el8jbcs |
jbcs-httpd24-mod_proxy_html-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 1:2.4.57-10.el8jbcs | 1:2.4.57-10.el8jbcs |
jbcs-httpd24-mod_securityRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.9.3-36.el8jbcs | 0:2.9.3-36.el8jbcs |
jbcs-httpd24-mod_security-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.9.3-36.el8jbcs | 0:2.9.3-36.el8jbcs |
jbcs-httpd24-mod_sessionRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-mod_session-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-mod_sslRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 1:2.4.57-10.el8jbcs | 1:2.4.57-10.el8jbcs |
jbcs-httpd24-mod_ssl-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 1:2.4.57-10.el8jbcs | 1:2.4.57-10.el8jbcs |
jbcs-httpd24-nghttp2Red Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:1.43.0-13.el8jbcs | 0:1.43.0-13.el8jbcs |
jbcs-httpd24-nghttp2-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:1.43.0-13.el8jbcs | 0:1.43.0-13.el8jbcs |
jbcs-httpd24-nghttp2-develRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:1.43.0-13.el8jbcs | 0:1.43.0-13.el8jbcs |
curlSUSE:Linux Micro 6.0 From an advisory covering 6 CVEs |
before 8.6.0-3.1 | 8.6.0-3.1 |
curlopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 8.7.1-1.1 | 8.7.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-2466 is a medium vulnerability (CVSS 6.5) in Curl, published March 27, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.45%, the 73rd percentile. Fixed in curl 8.7.1-r0.
References
curl.se/docs/CVE-2024-2466.json
hackerone.com/reports/2416725
openwall.com/lists/oss-security/2024/03/27/4
security.netapp.com/advisory/ntap-20240503-0010
support.apple.com/kb/HT214119
Show 64 moreShow less
seclists.org/fulldisclosure/2024/Jul/20
vicarius.io/vsociety/posts/tls-certificate-check-bypass-curl-with-mbedtls-cve-2024-2466-2468
cert-portal.siemens.com/productcert/html/ssa-398330.html
nvd.nist.gov/vuln/detail/CVE-2024-2466
github.com/advisories/GHSA-9xr6-qf7m-2jv5
security.alpinelinux.org/vuln/CVE-2024-2466
docs.bell-sw.com/security/cves/CVE-2024-2466
security-tracker.debian.org/tracker/CVE-2024-2466
advisories.mageia.org/MGASA-2024-0099.html
bugs.mageia.org/show_bug.cgi?id=33020
access.redhat.com/errata/RHSA-2024:2693
bugzilla.redhat.com/show_bug.cgi?id=2268277
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2693.json
cve.org/CVERecord?id=CVE-2024-2004
httpd.apache.org/security/vulnerabilities_24.html
nowotarski.info/http2-continuation-flood
kb.cert.org/vuls/id/421644
suse.com/support/update/announcement/2025/suse-su-202520029-1
bugzilla.suse.com/1221665