{"id":"CVE-2024-2004","aliases":["ALPINE-CVE-2024-2004","AZL-37076","AZL-37087","AZL-37102","AZL-37114","AZL-37117","BELL-CVE-2024-2004","CURL-CVE-2024-2004","DEBIAN-CVE-2024-2004","EUVD-2024-26974","GHSA-97xx-95pm-5qv6","JLSEC-2026-414","MGASA-2024-0099","RHSA-2024:2693","SUSE-SU-2024:1120-1","SUSE-SU-2024:1150-1","SUSE-SU-2024:1151-1","SUSE-SU-2024:1151-2","SUSE-SU-2024:1151-3","SUSE-SU-2025:20029-1","UBUNTU-CVE-2024-2004","USN-6718-1","USN-6718-3","openSUSE-SU-2024:13805-1"],"status":"published","title":"Usage of disabled protocol","description":"When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled.      curl --proto -all,-http http://curl.se  The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.","severity":{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-08","score":0.01681,"percentile":0.77106,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-436"],"published":"2024-03-27T07:00:00Z","modified":"2026-11-02T12:00:42Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"curl","fixed_in":["8.8.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cmake","fixed_in":["3.30.3-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"curl","fixed_in":["8.8.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"mysql","fixed_in":["8.0.40-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"mysql","fixed_in":["8.0.40-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"curl","fixed_in":["8.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.88.1-10+deb12u6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["8.7.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.7.1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.9.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.7.1+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"curl","fixed_in":["8.5.0-2ubuntu10.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.85.0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.85.0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.85.0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.85.0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.85.0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.85.0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.85.0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.85.0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.3-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.40-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.40-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0-r2"},{"fixed":"8.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10+deb12u6"}]}],"versions":["7.88.1-10","7.88.1-10+deb12u1","7.88.1-10+deb12u1~bpo11+1","7.88.1-10+deb12u2","7.88.1-10+deb12u3","7.88.1-10+deb12u3~bpo11+1","7.88.1-10+deb12u4","7.88.1-10+deb12u5","7.88.1-10+deb12u5~bpo11+1","7.88.1-10+deb12u6~bpo11+1"]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.5.0+0"},{"fixed":"8.9.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"7.87.0+0"},{"fixed":"8.7.1+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-4.3.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.19-37.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.19-37.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-6.redhat_1.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_jk-ap24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-6.redhat_1.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_jk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-6.redhat_1.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.24-6.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_md-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.24-6.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_proxy_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.20-4.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_proxy_cluster-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.20-4.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-36.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_security-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-36.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-13.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-13.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-nghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-13.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.19-37.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.19-37.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-6.redhat_1.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_jk-ap24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-6.redhat_1.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_jk-ap24-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-6.redhat_1.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.24-6.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_md-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.24-6.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.20-4.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_cluster-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.20-4.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-36.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_security-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-36.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-13.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-13.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-nghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-13.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.86.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.86.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.86.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Installer Updates 15 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Installer Updates 15 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.0-3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-2ubuntu10.1"}]}],"versions":["8.2.1-1ubuntu3","8.2.1-1ubuntu3.1","8.4.0-2ubuntu1","8.5.0-2ubuntu1","8.5.0-2ubuntu2","8.5.0-2ubuntu8","8.5.0-2ubuntu9","8.5.0-2ubuntu10"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.22"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4","7.68.0-1ubuntu2.5","7.68.0-1ubuntu2.6","7.68.0-1ubuntu2.7","7.68.0-1ubuntu2.10","7.68.0-1ubuntu2.11","7.68.0-1ubuntu2.12","7.68.0-1ubuntu2.13","7.68.0-1ubuntu2.14","7.68.0-1ubuntu2.15","7.68.0-1ubuntu2.16","7.68.0-1ubuntu2.18","7.68.0-1ubuntu2.19","7.68.0-1ubuntu2.20","7.68.0-1ubuntu2.21"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81.0-1ubuntu1.16"}]}],"versions":["7.74.0-1.3ubuntu2","7.74.0-1.3ubuntu3","7.80.0-3","7.81.0-1","7.81.0-1ubuntu1.1","7.81.0-1ubuntu1.2","7.81.0-1ubuntu1.3","7.81.0-1ubuntu1.4","7.81.0-1ubuntu1.6","7.81.0-1ubuntu1.7","7.81.0-1ubuntu1.8","7.81.0-1ubuntu1.10","7.81.0-1ubuntu1.11","7.81.0-1ubuntu1.13","7.81.0-1ubuntu1.14","7.81.0-1ubuntu1.15"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-2ubuntu10.1"}]}],"versions":["8.2.1-1ubuntu3","8.2.1-1ubuntu3.1","8.4.0-2ubuntu1","8.5.0-2ubuntu1","8.5.0-2ubuntu2","8.5.0-2ubuntu8","8.5.0-2ubuntu9","8.5.0-2ubuntu10"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-1.1"}]}],"bundled":4}],"products":[{"vendor":"apple","product":"macos"},{"vendor":"curl","product":"curl"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"haxx","product":"curl"},{"vendor":"netapp","product":"bootstrap_os"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"netapp","product":"ontap"},{"vendor":"netapp","product":"ontap_select_deploy_administration_utility"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"sinec nms"},{"vendor":"siemens","product":"sinema remote connect client"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://curl.se/docs/CVE-2024-2004.json","tags":["x_transferred","Vendor Advisory","web"]},{"url":"https://curl.se/docs/CVE-2024-2004.html","tags":["x_transferred","Vendor Advisory","web","advisory","article","report"]},{"url":"https://hackerone.com/reports/2384833","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/","tags":["x_transferred","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/27/1","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240524-0006/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://support.apple.com/kb/HT214119","tags":["x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"https://support.apple.com/kb/HT214118","tags":["x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"https://support.apple.com/kb/HT214120","tags":["x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/20","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/18","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/19","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-417159.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-331112.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2004","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20240524-0006","tags":["web"]},{"url":"https://github.com/advisories/GHSA-97xx-95pm-5qv6","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-2004","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-2004","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2004.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-2004","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0099.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33020","tags":["report"]},{"url":"https://curl.se/docs/CVE-2024-2398.html","tags":["advisory","article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2693","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.57/html/red_hat_jboss_core_services_apache_http_server_2.4.57_service_pack_4_release_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268277","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268639","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2270497","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2270498","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2270499","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2270500","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2693.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-2004","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-2004","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-2379","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-2379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2379","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2024-2379.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-2398","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-2398","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2398","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-2466","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-2466","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2466","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2024-2466.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-27316","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-27316","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27316","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["article"]},{"url":"https://nowotarski.info/http2-continuation-flood/","tags":["article"]},{"url":"https://www.kb.cert.org/vuls/id/421644","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-28182","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28182","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28182","tags":["advisory"]},{"url":"https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241120-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1221665","tags":["report"]},{"url":"https://bugzilla.suse.com/1221667","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2398","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241150-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241151-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241151-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241151-3/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520029-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1221666","tags":["report"]},{"url":"https://bugzilla.suse.com/1221668","tags":["report"]},{"url":"https://bugzilla.suse.com/1227888","tags":["report"]},{"url":"https://bugzilla.suse.com/1228535","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7264","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-2004","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6718-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6718-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-2398","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-2004","title":"Usage of disabled protocol","description":"When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled.      curl --proto -all,-http http://curl.se  The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.","status":"published","published":"2024-03-27T07:54:27.157Z","modified":"2026-10-15T00:21:19.167Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:34:10.258163Z"}],"euvd":[{"id":"EUVD-2024-26974","description":"When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled.      curl --proto -all,-http http://curl.se  The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.","status":"published","published":"2024-03-27T07:54:27Z","modified":"2026-10-15T00:21:19Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T17:27:11.209168Z"}],"ghsa":[{"id":"GHSA-97xx-95pm-5qv6","title":"When a protocol selection parameter option disables all protocols without adding any then the...","description":"When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled.      curl --proto -all,-http http://curl.se  The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.","status":"published","published":"2024-03-27T09:30:41Z","modified":"2024-10-29T18:30:34Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:58:38.070803Z"}],"nvd":[{"id":"CVE-2024-2004","description":"When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled.      curl --proto -all,-http http://curl.se  The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.","status":"published","published":"2024-03-27T08:15:41.173Z","modified":"2026-10-15T01:17:42.867Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:09:44.124823Z"}],"osv":[{"id":"ALPINE-CVE-2024-2004","description":"When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled.      curl --proto -all,-http http://curl.se  The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.","status":"published","published":"2024-03-27T08:15:41.173Z","modified":"2026-11-02T11:17:50.06668403Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2024-2004","status":"published","published":"2024-03-28T05:58:14.644919Z","modified":"2026-01-26T09:42:49.779588Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2024-2004","title":"Usage of disabled protocol","description":"When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled.      curl --proto -all,-http http://curl.se  The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.","status":"published","published":"2024-03-27T07:54:27.157Z","modified":"2026-10-28T02:30:38.192392877Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DEBIAN-CVE-2024-2004","description":"When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled.      curl --proto -all,-http http://curl.se  The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.","status":"published","published":"2024-03-27T08:15:41.173Z","modified":"2026-11-02T12:00:42.435565333Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"JLSEC-2026-414","title":"When a protocol selection parameter option disables all protocols without adding any then the...","description":"When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled.      curl --proto -all,-http http://curl.se  The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.","status":"published","published":"2026-05-04T13:12:06.605Z","modified":"2026-07-18T00:01:57.68645749Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"RHSA-2024:2693","title":"Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update","status":"published","published":"2024-09-30T20:22:07Z","modified":"2026-10-15T10:07:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"UBUNTU-CVE-2024-2004","description":"When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled.      curl --proto -all,-http http://curl.se  The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.","status":"published","published":"2024-03-27T07:00:00Z","modified":"2026-04-22T14:38:16.842202Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"AZL-37076","title":"CVE-2024-2004 affecting package curl for versions less than 8.8.0-1","description":"When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled.      curl --proto -all,-http http://curl.se  The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.","status":"published","published":"2024-03-27T08:15:41Z","modified":"2026-04-21T04:28:09.715727Z","updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-37087","title":"CVE-2024-2004 affecting package cmake for versions less than 3.30.3-2","description":"When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled.      curl --proto -all,-http http://curl.se  The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.","status":"published","published":"2024-03-27T08:15:41Z","modified":"2026-04-21T04:53:12.721583Z","updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-37102","title":"CVE-2024-2004 affecting package curl for versions less than 8.8.0-1","description":"When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled.      curl --proto -all,-http http://curl.se  The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.","status":"published","published":"2024-03-27T08:15:41Z","modified":"2026-04-21T04:48:06.347913Z","updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-37114","title":"CVE-2024-2004 affecting package mysql for versions less than 8.0.40-1","description":"When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled.      curl --proto -all,-http http://curl.se  The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.","status":"published","published":"2024-03-27T08:15:41Z","modified":"2026-04-21T04:50:16.880566Z","updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-37117","title":"CVE-2024-2004 affecting package mysql for versions less than 8.0.40-1","description":"When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled.      curl --proto -all,-http http://curl.se  The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.","status":"published","published":"2024-03-27T08:15:41Z","modified":"2026-04-21T04:28:12.975894Z","updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"CURL-CVE-2024-2004","title":"Usage of disabled protocol","description":"When a protocol selection parameter option disables all protocols without\nadding any then the default set of protocols would remain in the allowed set\ndue to an error in the logic for removing protocols. The below command would\nperform a request to curl.se with a plaintext protocol which has been\nexplicitly disabled.\n\n    curl --proto -all,-http http://curl.se\n\nThe flaw is only present if the set of selected protocols disables the entire\nset of available protocols, in itself a command with no practical use and\ntherefore unlikely to be encountered in real situations. The curl security team\nhas thus assessed this to be low severity bug.","status":"published","published":"2024-03-27T08:00:00Z","modified":"2026-10-25T01:05:23.732849566Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"MGASA-2024-0099","title":"Updated curl packages fix security vulnerabilities","description":"CVE-2024-2004: Usage of disabled protocol\nIf all protocols are disabled at run-time with none being added,\ncurl/libcurl would still allow communication with the default set of\nallowed protocols, including some that are unencrypted.\nCVE-2024-2398: HTTP/2 push headers memory-leak\nA memory leak could occur when an application enabled HTTP/2 server push\nand the server sent a large number of headers.\n","status":"published","published":"2024-03-29T03:49:09Z","modified":"2026-04-16T04:43:43.497904226Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13805-1","title":"curl-8.7.1-1.1 on GA media","description":"These are all security issues fixed in the curl-8.7.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:43:33.273516Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2024:1120-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2024-2004: Fix the uUsage of disabled protocol logic. (bsc#1221665)\n- CVE-2024-2398: Fix HTTP/2 push headers memory-leak. (bsc#1221667)\n","status":"published","published":"2024-04-05T12:03:51Z","modified":"2026-02-04T03:15:51.290554Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:1150-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2024-2004: Fix the uUsage of disabled protocol logic. (bsc#1221665)\n- CVE-2024-2398: Fix HTTP/2 push headers memory-leak. (bsc#1221667)\n","status":"published","published":"2024-04-08T09:35:59Z","modified":"2026-02-04T02:30:01.034941Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:1151-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2024-2004: Fix the uUsage of disabled protocol logic. (bsc#1221665)\n- CVE-2024-2398: Fix HTTP/2 push headers memory-leak. (bsc#1221667)\n","status":"published","published":"2024-04-08T09:36:28Z","modified":"2026-02-04T03:45:00.061858Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:1151-2","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2024-2004: Fix the uUsage of disabled protocol logic. (bsc#1221665)\n- CVE-2024-2398: Fix HTTP/2 push headers memory-leak. (bsc#1221667)\n","status":"published","published":"2024-05-06T15:40:42Z","modified":"2026-02-04T04:03:18.857182Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:1151-3","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2024-2004: Fix the uUsage of disabled protocol logic. (bsc#1221665)\n- CVE-2024-2398: Fix HTTP/2 push headers memory-leak. (bsc#1221667)\n","status":"published","published":"2024-04-08T09:36:44Z","modified":"2026-02-04T02:36:05.158549Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2025:20029-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2024-7264: ASN.1 date parser overread (bsc#1228535)\n- CVE-2024-6197: Freeing stack buffer in utf8asn1str (bsc#1227888)\n- CVE-2024-2379: QUIC certificate check bypass with wolfSSL (bsc#1221666)\n- CVE-2024-2466: TLS certificate check bypass with mbedTLS (bsc#1221668)\n- CVE-2024-2004: Usage of disabled protocol (bsc#1221665)\n- CVE-2024-2398: HTTP/2 push headers memory-leak (bsc#1221667)\n\nNon-security issue fixed:\n\n- Fixed various TLS related issues including FTP over SSL transmission timeouts.\n","status":"published","published":"2025-02-03T08:51:25Z","modified":"2026-03-23T04:50:02.900924Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-6718-1","title":"curl vulnerabilities","description":"Dan Fandrich discovered that curl would incorrectly use the default set of\nprotocols when a parameter option disabled all protocols without adding\nany, contrary to expectations. This issue only affected Ubuntu 23.10.\n(CVE-2024-2004)\n\nIt was discovered that curl incorrectly handled memory when limiting the\namount of headers when HTTP/2 server push is allowed. A remote attacker\ncould possibly use this issue to cause curl to consume resources, leading\nto a denial of service. (CVE-2024-2398)\n","status":"published","published":"2024-03-27T11:43:38Z","modified":"2026-04-27T17:17:26.259980592Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6718-3","title":"curl vulnerabilities","description":"USN-6718-1 fixed vulnerabilities in curl. This update provides the\ncorresponding updates for Ubuntu 24.04 LTS.\n\nOriginal advisory details:\n\n Dan Fandrich discovered that curl would incorrectly use the default set of\n protocols when a parameter option disabled all protocols without adding\n any, contrary to expectations. This issue only affected Ubuntu 23.10.\n (CVE-2024-2004)\n \n It was discovered that curl incorrectly handled memory when limiting the\n amount of headers when HTTP/2 server push is allowed. A remote attacker\n could possibly use this issue to cause curl to consume resources, leading\n to a denial of service. (CVE-2024-2398)\n","status":"published","published":"2024-04-29T11:34:42Z","modified":"2026-04-27T17:17:21.450620369Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}