{"id":"CVE-2024-2379","aliases":["ALPINE-CVE-2024-2379","AZL-42966","BELL-CVE-2024-2379","CURL-CVE-2024-2379","DEBIAN-CVE-2024-2379","EUVD-2024-27332","GHSA-wr4c-gwg7-p734","JLSEC-2026-415","MGASA-2024-0099","RHSA-2024:2693","ROOT-OS-DEBIAN-12-CVE-2024-2379","SUSE-SU-2025:20029-1","openSUSE-SU-2024:13805-1"],"status":"published","title":"QUIC certificate check bypass with wolfSSL","description":"libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.01863,"percentile":0.79417,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2024-03-27T07:56:41Z","modified":"2026-11-04T07:15:10Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cmake","fixed_in":["3.30.3-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["8.7.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.7.1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.9.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.7.1+0"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"curl","fixed_in":["7.88.1-10+deb12u14.root.io.11","7.88.1-10+deb12u14.root.io.10","7.88.1-10+deb12u15.aikido.13","7.88.1-10+deb12u15.aikido.14","7.88.1-10+deb12u15.aikido.15","7.88.1-10+deb12u15.aikido.16","7.88.1-10+deb12u15.aikido.17","7.88.1-10+deb12u15.aikido.18","7.88.1-10+deb12u15.aikido.19","7.88.1-10+deb12u15.aikido.20"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-curl","fixed_in":["7.88.1-10+deb12u14.root.io.11","7.88.1-10+deb12u14.root.io.10","7.88.1-10+deb12u15.aikido.13","7.88.1-10+deb12u15.aikido.14","7.88.1-10+deb12u15.aikido.15","7.88.1-10+deb12u15.aikido.16","7.88.1-10+deb12u15.aikido.17","7.88.1-10+deb12u15.aikido.18","7.88.1-10+deb12u15.aikido.19","7.88.1-10+deb12u15.aikido.20"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.3-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.6.0-r0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.6.0-r0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.88.1-10","7.88.1-10+deb12u1","7.88.1-10+deb12u11","7.88.1-10+deb12u12","7.88.1-10+deb12u13","7.88.1-10+deb12u14","7.88.1-10+deb12u15","7.88.1-10+deb12u1~bpo11+1","7.88.1-10+deb12u2","7.88.1-10+deb12u3","7.88.1-10+deb12u3~bpo11+1","7.88.1-10+deb12u4","7.88.1-10+deb12u5","7.88.1-10+deb12u5~bpo11+1","7.88.1-10+deb12u6","7.88.1-10+deb12u6~bpo11+1","7.88.1-10+deb12u7","7.88.1-10+deb12u8","7.88.1-10+deb12u9","7.88.1-11","8.0.1-1~exp1","8.10.0-1","8.10.0-2","8.10.1-1","8.10.1-1~bpo12+1","8.10.1-2","8.11.0-1","8.11.1-1","8.11.1-1~bpo12+1","8.12.0+git20250209.89ed161+ds-1","8.12.0+git20250209.89ed161+ds-1~bpo12+1","8.12.1-1","8.12.1-2","8.12.1-2~bpo12+1","8.12.1-3","8.12.1-3~bpo12+1","8.13.0-1","8.13.0-1+exp1","8.13.0-2","8.13.0-2+exp1","8.13.0-3","8.13.0-4","8.13.0-4+exp1","8.13.0-5","8.13.0-5+exp1","8.13.0-5~bpo12+1","8.13.0~rc-1~exp1","8.13.0~rc-1~exp2","8.13.0~rc2-1","8.13.0~rc2-2","8.13.0~rc3-1","8.13.0~rc3-1+exp1","8.14.0-1","8.14.0-1+exp1","8.14.0~rc1-1+exp1","8.14.0~rc2-1+exp1","8.14.0~rc3-1+exp1","8.14.1-1","8.14.1-1~bpo12+1","8.14.1-2","8.14.1-2+exp1","8.14.1-2~bpo12+1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.2.1-1","8.2.1-2","8.2.1-2~bpo12+1","8.20.0-1","8.20.0-1+exp","8.20.0-2","8.20.0-2+exp1","8.20.0-2~bpo13+1","8.20.0-3","8.20.0-4","8.20.0-5","8.20.0-5~bpo13+1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1","8.20.0~rc3-1","8.20.0~rc3-1+exp1","8.21.0-1","8.21.0-1+exp1","8.21.0-2","8.21.0-2+exp1","8.21.0-2~bpo13+1","8.21.0~rc1-1+exp1","8.21.0~rc2-1","8.21.0~rc2-1+exp1","8.21.0~rc3-1","8.21.0~rc3-1+exp1","8.22.0-1","8.22.0-1+exp1","8.22.0~rc2-1","8.22.0~rc2-2","8.22.0~rc3-1","8.22.0~rc3-1+exp1","8.23.0-1","8.23.0~rc1-1","8.23.0~rc1-2","8.23.0~rc2-1","8.23.0~rc2-1+exp1","8.23.0~rc3-1","8.23.0~rc3-1+exp1","8.3.0-1","8.3.0-2","8.3.0-2~bpo12+1","8.3.0-2~exp1","8.3.0-3","8.4.0-1","8.4.0-2","8.4.0-2~bpo12+1","8.5.0-1","8.5.0-1+exp1","8.5.0-2","8.5.0-2+exp1","8.5.0-2~bpo12+1","8.6.0-1","8.6.0-1.1","8.6.0-2","8.6.0-3","8.6.0-3.1","8.6.0-3.1~exp1","8.6.0-3.1~exp2","8.6.0-3.2","8.6.0-4","8.7.1-1","8.7.1-1+exp1","8.7.1-2","8.7.1-3","8.7.1-4","8.7.1-5","8.7.1-5+exp1","8.7.1-5~bpo12+1","8.8.0-1","8.8.0-1+exp1","8.8.0-1+exp2","8.8.0-1~bpo12+1","8.8.0-2","8.8.0-3","8.8.0-4","8.9.0-1","8.9.0-2","8.9.0-3","8.9.1-1","8.9.1-2","8.9.1-2~bpo12+1"]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.6.0+0"},{"fixed":"8.9.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.6.0+0"},{"fixed":"8.7.1+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-4.3.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.19-37.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.19-37.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-6.redhat_1.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_jk-ap24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-6.redhat_1.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_jk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-6.redhat_1.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.24-6.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_md-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.24-6.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_proxy_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.20-4.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_proxy_cluster-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.20-4.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-36.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_security-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-36.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-13.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-13.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-nghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-13.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.19-37.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.19-37.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-6.redhat_1.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_jk-ap24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-6.redhat_1.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_jk-ap24-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-6.redhat_1.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.24-6.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_md-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.24-6.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.20-4.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_cluster-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.20-4.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-36.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_security-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-36.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-13.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-13.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-nghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-13.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Root:Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10+deb12u14.root.io.11"},{"fixed":"7.88.1-10+deb12u14.root.io.10"},{"fixed":"7.88.1-10+deb12u15.aikido.13"},{"fixed":"7.88.1-10+deb12u15.aikido.14"},{"fixed":"7.88.1-10+deb12u15.aikido.15"},{"fixed":"7.88.1-10+deb12u15.aikido.16"},{"fixed":"7.88.1-10+deb12u15.aikido.17"},{"fixed":"7.88.1-10+deb12u15.aikido.18"},{"fixed":"7.88.1-10+deb12u15.aikido.19"},{"fixed":"7.88.1-10+deb12u15.aikido.20"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10+deb12u14.root.io.11"},{"fixed":"7.88.1-10+deb12u14.root.io.10"},{"fixed":"7.88.1-10+deb12u15.aikido.13"},{"fixed":"7.88.1-10+deb12u15.aikido.14"},{"fixed":"7.88.1-10+deb12u15.aikido.15"},{"fixed":"7.88.1-10+deb12u15.aikido.16"},{"fixed":"7.88.1-10+deb12u15.aikido.17"},{"fixed":"7.88.1-10+deb12u15.aikido.18"},{"fixed":"7.88.1-10+deb12u15.aikido.19"},{"fixed":"7.88.1-10+deb12u15.aikido.20"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.0-3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-1.1"}]}],"bundled":4}],"products":[{"vendor":"apple","product":"macos"},{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"curl"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"bootstrap_os"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h610c_firmware"},{"vendor":"netapp","product":"h610s_firmware"},{"vendor":"netapp","product":"h615c_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"netapp","product":"ontap_select_deploy_administration_utility"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"sinec nms"},{"vendor":"siemens","product":"sinema remote connect client"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://curl.se/docs/CVE-2024-2379.json","tags":["x_transferred","Vendor Advisory","web"]},{"url":"https://curl.se/docs/CVE-2024-2379.html","tags":["x_transferred","Vendor Advisory","web","article"]},{"url":"https://hackerone.com/reports/2410774","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/27/2","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240531-0001/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://support.apple.com/kb/HT214119","tags":["x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"https://support.apple.com/kb/HT214118","tags":["x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"https://support.apple.com/kb/HT214120","tags":["x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/20","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/18","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/19","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-417159.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-331112.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2379","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240531-0001","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wr4c-gwg7-p734","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-2379","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-2379","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2379.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-2379","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0099.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33020","tags":["report"]},{"url":"https://curl.se/docs/CVE-2024-2004.html","tags":["advisory","article"]},{"url":"https://curl.se/docs/CVE-2024-2398.html","tags":["advisory","article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2693","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.57/html/red_hat_jboss_core_services_apache_http_server_2.4.57_service_pack_4_release_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268277","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268639","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2270497","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2270498","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2270499","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2270500","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2693.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-2004","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-2004","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2004","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-2379","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-2379","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-2398","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-2398","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2398","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-2466","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-2466","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2466","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2024-2466.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-27316","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-27316","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27316","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["article"]},{"url":"https://nowotarski.info/http2-continuation-flood/","tags":["article"]},{"url":"https://www.kb.cert.org/vuls/id/421644","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-28182","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28182","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28182","tags":["advisory"]},{"url":"https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520029-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1221665","tags":["report"]},{"url":"https://bugzilla.suse.com/1221666","tags":["report"]},{"url":"https://bugzilla.suse.com/1221667","tags":["report"]},{"url":"https://bugzilla.suse.com/1221668","tags":["report"]},{"url":"https://bugzilla.suse.com/1227888","tags":["report"]},{"url":"https://bugzilla.suse.com/1228535","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7264","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-2379","title":"QUIC certificate check bypass with wolfSSL","description":"libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.","status":"published","published":"2024-03-27T07:56:41.158Z","modified":"2026-10-15T00:21:23.024Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:34:10.258163Z"}],"euvd":[{"id":"EUVD-2024-27332","description":"libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.","status":"published","published":"2024-03-27T07:56:41Z","modified":"2026-10-15T00:21:23Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T17:27:10.794682Z"}],"ghsa":[{"id":"GHSA-wr4c-gwg7-p734","title":"libcurl skips the certificate verification for a QUIC connection under certain conditions, when...","description":"libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.","status":"published","published":"2024-03-27T09:30:41Z","modified":"2026-10-15T03:34:18Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:13:30.561319Z"}],"nvd":[{"id":"CVE-2024-2379","description":"libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.","status":"published","published":"2024-03-27T08:15:41.23Z","modified":"2026-10-15T01:17:43.293Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:09:44.124823Z"}],"osv":[{"id":"ALPINE-CVE-2024-2379","description":"libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.","status":"published","published":"2024-03-27T08:15:41.23Z","modified":"2026-11-02T11:17:50.075772564Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2024-2379","status":"published","published":"2024-03-28T05:58:14.817909Z","modified":"2026-01-26T09:42:51.183051Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2024-2379","title":"QUIC certificate check bypass with wolfSSL","description":"libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.","status":"published","published":"2024-03-27T07:56:41.158Z","modified":"2026-10-28T02:30:24.089842024Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:38.897406Z"},{"id":"DEBIAN-CVE-2024-2379","description":"libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.","status":"published","published":"2024-03-27T08:15:41.23Z","modified":"2026-11-02T12:00:49.949509272Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"JLSEC-2026-415","title":"libcurl skips the certificate verification for a QUIC connection under certain conditions, when...","description":"libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.","status":"published","published":"2026-05-04T13:12:06.605Z","modified":"2026-07-18T00:01:57.647560907Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"RHSA-2024:2693","title":"Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update","status":"published","published":"2024-09-30T20:22:07Z","modified":"2026-10-15T10:07:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"AZL-42966","title":"CVE-2024-2379 affecting package cmake for versions less than 3.30.3-2","description":"libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.","status":"published","published":"2024-03-27T08:15:41Z","modified":"2026-04-21T04:53:05.266075Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"CURL-CVE-2024-2379","title":"QUIC certificate check bypass with wolfSSL","description":"libcurl skips the certificate verification for a QUIC connection under certain\nconditions, when built to use wolfSSL. If told to use an unknown/bad cipher or\ncurve, the error path accidentally skips the verification and returns OK, thus\nignoring any certificate problems.","status":"published","published":"2024-03-27T08:00:00Z","modified":"2026-10-25T01:05:24.934218124Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"MGASA-2024-0099","title":"Updated curl packages fix security vulnerabilities","description":"CVE-2024-2004: Usage of disabled protocol\nIf all protocols are disabled at run-time with none being added,\ncurl/libcurl would still allow communication with the default set of\nallowed protocols, including some that are unencrypted.\nCVE-2024-2398: HTTP/2 push headers memory-leak\nA memory leak could occur when an application enabled HTTP/2 server push\nand the server sent a large number of headers.\n","status":"published","published":"2024-03-29T03:49:09Z","modified":"2026-04-16T04:43:43.497904226Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13805-1","title":"curl-8.7.1-1.1 on GA media","description":"These are all security issues fixed in the curl-8.7.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:43:33.273516Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2024-2379","title":"CVE-2024-2379 in curl - Patched by Root","description":"Root has patched CVE-2024-2379 in the curl package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-11-04T06:00:50Z","modified":"2026-11-04T07:15:10.380832163Z","updated_at":"2026-11-04T07:32:10.855619Z"},{"id":"SUSE-SU-2025:20029-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2024-7264: ASN.1 date parser overread (bsc#1228535)\n- CVE-2024-6197: Freeing stack buffer in utf8asn1str (bsc#1227888)\n- CVE-2024-2379: QUIC certificate check bypass with wolfSSL (bsc#1221666)\n- CVE-2024-2466: TLS certificate check bypass with mbedTLS (bsc#1221668)\n- CVE-2024-2004: Usage of disabled protocol (bsc#1221665)\n- CVE-2024-2398: HTTP/2 push headers memory-leak (bsc#1221667)\n\nNon-security issue fixed:\n\n- Fixed various TLS related issues including FTP over SSL transmission timeouts.\n","status":"published","published":"2025-02-03T08:51:25Z","modified":"2026-03-23T04:50:02.900924Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}