{"id":"CVE-2024-2466","aliases":["ALPINE-CVE-2024-2466","AZL-37077","AZL-37103","AZL-42972","BELL-CVE-2024-2466","CURL-CVE-2024-2466","DEBIAN-CVE-2024-2466","EUVD-2024-27415","GHSA-9xr6-qf7m-2jv5","JLSEC-2026-417","MGASA-2024-0099","RHSA-2024:2693","SUSE-SU-2025:20029-1","openSUSE-SU-2024:13805-1"],"status":"published","title":"TLS certificate check bypass with mbedTLS","description":"libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.  libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.01453,"percentile":0.73636,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-297"],"published":"2024-03-27T07:58:24Z","modified":"2026-11-02T12:00:58Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"curl","fixed_in":["8.8.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"curl","fixed_in":["8.8.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cmake","fixed_in":["3.30.3-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"curl","fixed_in":["8.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"curl","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["8.7.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.7.1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.9.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.7.1+0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.3-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0-r0"},{"fixed":"8.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0-r0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0-r0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.5.0+0"},{"fixed":"8.9.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.5.0+0"},{"fixed":"8.7.1+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-4.3.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.19-37.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.19-37.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-6.redhat_1.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_jk-ap24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-6.redhat_1.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_jk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-6.redhat_1.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.24-6.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_md-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.24-6.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_proxy_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.20-4.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_proxy_cluster-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.20-4.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-36.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_security-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-36.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-10.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-13.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-13.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-nghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-13.el7jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7.1-2.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.19-37.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.19-37.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-6.redhat_1.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_jk-ap24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-6.redhat_1.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_jk-ap24-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-6.redhat_1.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.24-6.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_md-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.24-6.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.20-4.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_cluster-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.20-4.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-36.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_security-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-36.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-10.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-13.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-13.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-nghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-13.el8jbcs"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.0-3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-1.1"}]}],"bundled":4}],"products":[{"vendor":"apple","product":"macos"},{"vendor":"curl","product":"curl"},{"vendor":"curl","product":"libcurl"},{"vendor":"haxx","product":"curl"},{"vendor":"netapp","product":"bootstrap_os"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"sinec nms"},{"vendor":"siemens","product":"sinema remote connect client"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://curl.se/docs/CVE-2024-2466.json","tags":["x_transferred","Vendor Advisory","web"]},{"url":"https://curl.se/docs/CVE-2024-2466.html","tags":["x_transferred","Vendor Advisory","web","article"]},{"url":"https://hackerone.com/reports/2416725","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/27/4","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240503-0010/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://support.apple.com/kb/HT214119","tags":["x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"https://support.apple.com/kb/HT214118","tags":["x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"https://support.apple.com/kb/HT214120","tags":["x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/20","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/18","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/19","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://www.vicarius.io/vsociety/posts/tls-certificate-check-bypass-curl-with-mbedtls-cve-2024-2466-2468","tags":["Exploit","Mitigation","Third Party Advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-417159.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-331112.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2466","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240503-0010","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9xr6-qf7m-2jv5","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-2466","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-2466","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2466.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-2466","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0099.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33020","tags":["report"]},{"url":"https://curl.se/docs/CVE-2024-2004.html","tags":["advisory","article"]},{"url":"https://curl.se/docs/CVE-2024-2398.html","tags":["advisory","article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2693","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.57/html/red_hat_jboss_core_services_apache_http_server_2.4.57_service_pack_4_release_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268277","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268639","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2270497","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2270498","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2270499","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2270500","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2693.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-2004","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-2004","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2004","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-2379","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-2379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2379","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2024-2379.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-2398","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-2398","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2398","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-2466","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-2466","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-27316","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-27316","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27316","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["article"]},{"url":"https://nowotarski.info/http2-continuation-flood/","tags":["article"]},{"url":"https://www.kb.cert.org/vuls/id/421644","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-28182","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28182","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28182","tags":["advisory"]},{"url":"https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520029-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1221665","tags":["report"]},{"url":"https://bugzilla.suse.com/1221666","tags":["report"]},{"url":"https://bugzilla.suse.com/1221667","tags":["report"]},{"url":"https://bugzilla.suse.com/1221668","tags":["report"]},{"url":"https://bugzilla.suse.com/1227888","tags":["report"]},{"url":"https://bugzilla.suse.com/1228535","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7264","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-2466","title":"TLS certificate check bypass with mbedTLS","description":"libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.  libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).","status":"published","published":"2024-03-27T07:58:24.52Z","modified":"2026-10-15T00:21:26.076Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-297"],"updated_at":"2026-11-02T14:34:10.258163Z"}],"euvd":[{"id":"EUVD-2024-27415","description":"libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.  libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).","status":"published","published":"2024-03-27T07:58:24Z","modified":"2026-10-15T00:21:26Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:10.794682Z"}],"ghsa":[{"id":"GHSA-9xr6-qf7m-2jv5","title":"libcurl did not check the server certificate of TLS connections done to a host specified as an IP...","description":"libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.  libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).","status":"published","published":"2024-03-27T09:30:41Z","modified":"2026-10-15T03:34:17Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-297"],"updated_at":"2026-11-02T15:13:30.561319Z"}],"nvd":[{"id":"CVE-2024-2466","description":"libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.  libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).","status":"published","published":"2024-03-27T08:15:41.343Z","modified":"2026-10-15T01:17:43.823Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-297"],"updated_at":"2026-11-02T14:09:44.124823Z"}],"osv":[{"id":"ALPINE-CVE-2024-2466","description":"libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.  libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).","status":"published","published":"2024-03-27T08:15:41.343Z","modified":"2026-11-02T11:17:50.07696082Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2024-2466","status":"published","published":"2024-03-28T05:58:14.979724Z","modified":"2026-01-26T09:35:59.758628Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2024-2466","title":"TLS certificate check bypass with mbedTLS","description":"libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.  libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).","status":"published","published":"2024-03-27T07:58:24.52Z","modified":"2026-10-28T02:30:43.026290754Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:38.897406Z"},{"id":"DEBIAN-CVE-2024-2466","description":"libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.  libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).","status":"published","published":"2024-03-27T08:15:41.343Z","modified":"2026-11-02T12:00:58.856823578Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"JLSEC-2026-417","title":"libcurl did not check the server certificate of TLS connections done to a host specified as an IP...","description":"libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.  libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).","status":"published","published":"2026-05-04T13:12:06.605Z","modified":"2026-07-18T00:01:59.62032753Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"RHSA-2024:2693","title":"Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update","status":"published","published":"2024-09-30T20:22:07Z","modified":"2026-10-15T10:07:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"AZL-37077","title":"CVE-2024-2466 affecting package curl for versions less than 8.8.0-1","description":"libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.  libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).","status":"published","published":"2024-03-27T08:15:41Z","modified":"2026-04-21T04:28:09.863159Z","updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-37103","title":"CVE-2024-2466 affecting package curl for versions less than 8.8.0-1","description":"libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.  libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).","status":"published","published":"2024-03-27T08:15:41Z","modified":"2026-04-21T04:56:49.214071Z","updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-42972","title":"CVE-2024-2466 affecting package cmake for versions less than 3.30.3-2","description":"libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.  libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).","status":"published","published":"2024-03-27T08:15:41Z","modified":"2026-04-21T04:48:32.101232Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"CURL-CVE-2024-2466","title":"TLS certificate check bypass with mbedTLS","description":"libcurl did not check the server certificate of TLS connections done to a host\nspecified as an IP address, when built to use mbedTLS.\n\nlibcurl would wrongly avoid using the set hostname function when the specified\nhostname was given as an IP address, therefore completely skipping the\ncertificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS,\nPOPS3, SMTPS, etc).","status":"published","published":"2024-03-27T08:00:00Z","modified":"2026-10-25T01:04:35.280284739Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"MGASA-2024-0099","title":"Updated curl packages fix security vulnerabilities","description":"CVE-2024-2004: Usage of disabled protocol\nIf all protocols are disabled at run-time with none being added,\ncurl/libcurl would still allow communication with the default set of\nallowed protocols, including some that are unencrypted.\nCVE-2024-2398: HTTP/2 push headers memory-leak\nA memory leak could occur when an application enabled HTTP/2 server push\nand the server sent a large number of headers.\n","status":"published","published":"2024-03-29T03:49:09Z","modified":"2026-04-16T04:43:43.497904226Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13805-1","title":"curl-8.7.1-1.1 on GA media","description":"These are all security issues fixed in the curl-8.7.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:43:33.273516Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2025:20029-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2024-7264: ASN.1 date parser overread (bsc#1228535)\n- CVE-2024-6197: Freeing stack buffer in utf8asn1str (bsc#1227888)\n- CVE-2024-2379: QUIC certificate check bypass with wolfSSL (bsc#1221666)\n- CVE-2024-2466: TLS certificate check bypass with mbedTLS (bsc#1221668)\n- CVE-2024-2004: Usage of disabled protocol (bsc#1221665)\n- CVE-2024-2398: HTTP/2 push headers memory-leak (bsc#1221667)\n\nNon-security issue fixed:\n\n- Fixed various TLS related issues including FTP over SSL transmission timeouts.\n","status":"published","published":"2025-02-03T08:51:25Z","modified":"2026-03-23T04:50:02.900924Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}