CVE-2024-2398: Haxx Curl Information Disclosure Flaw

CVE-2024-2398 Overview

CVE-2024-2398 is a memory leak vulnerability in libcurl that affects applications using HTTP/2 server push functionality. When an application enables HTTP/2 server push and the number of received headers for a push exceeds the maximum allowed limit of 1000 headers, libcurl aborts the server push operation. During this abort process, libcurl fails to properly free all previously allocated header memory, resulting in a memory leak. Critically, this error condition fails silently, making it difficult for applications to detect and respond to the issue.

Critical Impact

Memory leak vulnerability in libcurl's HTTP/2 server push handling can lead to resource exhaustion and potential denial of service conditions in affected applications. The silent failure nature makes detection particularly challenging.

Affected Products

• Haxx curl
• Apple macOS
• Fedora Project Fedora (versions 39 and 40)
• NetApp Active IQ Unified Manager
• NetApp ONTAP Select Deploy Administration Utility
• NetApp Brocade Fabric Operating System
• NetApp Bootstrap OS
• NetApp HCI Compute Node
• NetApp H-Series Storage Systems (H300S, H410S, H500S, H610C, H610S, H615C, H700S)

Discovery Timeline

• March 27, 2024 - CVE-2024-2398 published to NVD
• July 30, 2025 - Last updated in NVD database

Technical Details for CVE-2024-2398

Vulnerability Analysis

This vulnerability is classified as CWE-772 (Missing Release of Resource after Effective Lifetime). The issue occurs within libcurl's HTTP/2 server push implementation, specifically when handling header data during push operations. When a malicious or misconfigured server sends more than 1000 headers in an HTTP/2 server push, libcurl correctly identifies this as an error condition and aborts the push. However, the abort code path contains a flaw where previously allocated memory for headers is not properly released before the function returns.

The vulnerability is particularly concerning because the memory leak occurs silently without generating any error messages or return codes that would alert the application to the issue. This means applications may continue operating normally while steadily consuming more memory, eventually leading to resource exhaustion.

Root Cause

The root cause is improper resource cleanup in libcurl's HTTP/2 server push abort handling code. When the header count exceeds 1000, the abort logic fails to iterate through and free all previously allocated header structures before returning from the function. This represents a classic resource management failure where an error handling path does not properly clean up resources that were allocated during normal operation.

Attack Vector

An attacker with network access can exploit this vulnerability by controlling or compromising an HTTP/2 server that communicates with a vulnerable libcurl client. The attack involves sending HTTP/2 server push responses containing more than 1000 headers. Each time the client processes such a malicious push, memory is leaked. By repeatedly triggering this condition, an attacker can cause gradual memory exhaustion on the client system.

The attack is particularly effective because:

• It requires no authentication
• It can be triggered remotely over the network
• The victim application receives no indication of the ongoing attack
• The memory leak accumulates with each malicious push attempt

The vulnerability was reported through the HackerOne Report #2402845 bug bounty program. For detailed technical information, refer to the CURL CVE-2024-2398 Documentation.

Detection Methods for CVE-2024-2398

Indicators of Compromise

• Gradual increase in memory consumption by applications using libcurl with HTTP/2 server push enabled
• Unusual HTTP/2 server push traffic with abnormally high header counts from external servers
• Application performance degradation or crashes due to memory exhaustion
• Connections to suspicious HTTP/2 servers that consistently trigger push operations

Detection Strategies

• Monitor memory usage patterns of applications that utilize libcurl for HTTP/2 communications
• Implement network traffic analysis to detect HTTP/2 push responses with excessive header counts (>1000)
• Deploy endpoint detection rules to identify processes consuming memory at abnormal rates without corresponding activity increases
• Use application performance monitoring to track libcurl-based applications for memory leak indicators

Monitoring Recommendations

• Enable detailed logging for HTTP/2 connections and server push operations where feasible
• Implement memory usage thresholds and alerts for critical applications using libcurl
• Monitor network traffic for patterns consistent with HTTP/2 server push abuse
• Regularly audit systems for outdated libcurl versions using software composition analysis tools

How to Mitigate CVE-2024-2398

Immediate Actions Required

• Update libcurl to the latest patched version immediately
• If unable to patch immediately, disable HTTP/2 server push functionality using CURLMOPT_PUSHFUNCTION set to return CURL_PUSH_DENY
• Audit all applications and systems that incorporate libcurl for HTTP/2 functionality
• Implement memory monitoring for applications using vulnerable versions until patches can be applied

Patch Information

Security patches are available from multiple vendors. The curl project has released fixes as documented in the CURL CVE-2024-2398 Documentation. Apple has addressed this vulnerability in macOS updates detailed in Apple Support Document HT214118, HT214119, and HT214120. Fedora users should apply updates as announced in the Fedora Package Announcement. NetApp customers should refer to NetApp Security Advisory NTAP-20240503-0009.

Workarounds

• Disable HTTP/2 server push by configuring the application to reject all push promises
• Implement application-level memory monitoring and automatic restarts when thresholds are exceeded
• Use network-level filtering to block or rate-limit HTTP/2 push responses from untrusted servers
• Consider downgrading to HTTP/1.1 for connections to untrusted servers until patching is complete

# Example: Disable HTTP/2 server push in curl command line
curl --http2 --no-push https://example.com/

# For applications using libcurl, set push callback to deny all pushes:
# curl_multi_setopt(multi_handle, CURLMOPT_PUSHFUNCTION, deny_push_callback);