CVE-2024-2466 Overview
CVE-2024-2466 is a certificate validation flaw in libcurl when built against the mbedTLS backend. The library skips the server certificate check for Transport Layer Security (TLS) connections made to hosts specified as IP addresses. libcurl incorrectly bypasses the mbedtls_ssl_set_hostname function when the target hostname is an IP literal, disabling the certificate verification path entirely. The defect affects every TLS-based protocol supported by libcurl, including HTTPS, FTPS, IMAPS, POP3S, and SMTPS. The issue is classified under CWE-297: Improper Validation of Certificate with Host Mismatch.
Critical Impact
Attackers positioned on the network path can perform machine-in-the-middle attacks against libcurl-mbedTLS clients connecting to IP-addressed endpoints, intercepting or altering TLS-protected traffic without detection.
Affected Products
- Haxx curl (builds compiled with the mbedTLS backend)
- Apple macOS (versions addressed in HT214118, HT214119, HT214120)
- NetApp HCI Compute Node, Bootstrap OS, and H300S/H410S/H500S/H700S storage node firmware
Discovery Timeline
- 2024-03-27 - CVE CVE-2024-2466 published to the National Vulnerability Database
- 2024-05-03 - NetApp publishes advisory ntap-20240503-0010
- 2024-07-18 - Full Disclosure mailing list coverage published
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-2466
Vulnerability Analysis
libcurl relies on the underlying TLS backend to validate that the peer certificate matches the requested host. For mbedTLS, this binding is established by calling mbedtls_ssl_set_hostname before the handshake. When the destination is an IP literal, libcurl incorrectly skipped this call because Server Name Indication (SNI) is not sent for IP hosts.
Skipping the hostname assignment also disabled mbedTLS's server certificate verification path. The client completes the TLS handshake against any certificate the server presents, including self-signed or attacker-controlled certificates. The confidentiality and integrity guarantees of TLS are lost for any request whose URL uses an IP address rather than a DNS name.
This behavior contradicts the expectation set by CURLOPT_SSL_VERIFYPEER=1, which callers use to enforce certificate validation. Applications and appliances that resolve destinations to IP addresses before invoking libcurl are particularly exposed. The Vicarius advisory documents the same root cause in the sibling issue CVE-2024-2468.
Root Cause
The code path handling IP-literal targets short-circuits the hostname configuration used by mbedTLS. Because mbedTLS gates certificate verification on a configured hostname, omitting the assignment silently disables validation instead of falling back to Subject Alternative Name IP matching.
Attack Vector
Exploitation requires an attacker in a network position between the libcurl client and the intended server, such as a rogue router, ARP-spoofing host, malicious Wi-Fi access point, or compromised upstream ISP node. The attacker terminates the TLS connection with a certificate for any identity, and the libcurl-mbedTLS client accepts it. No user interaction or privileges are required. See the curl security advisory for the full technical write-up.
No verified public exploit code is available. The vulnerability is described in prose only; see the HackerOne report #2416725 for the disclosure record.
Detection Methods for CVE-2024-2466
Indicators of Compromise
- Outbound HTTPS, FTPS, IMAPS, POP3S, or SMTPS sessions from libcurl-based clients to bare IP addresses that terminate on unexpected certificate issuers.
- TLS certificates presented on internal flows that do not chain to the organization's approved certificate authorities.
- Application logs from tools linking libcurl + mbedTLS that show successful connections to IP hosts despite certificate anomalies.
Detection Strategies
- Inventory binaries and appliances that statically or dynamically link libcurl compiled against mbedTLS, using software composition analysis on build manifests and package metadata.
- Correlate TLS session metadata from network sensors with the client process to flag IP-literal destinations that skip SNI.
- Compare presented certificate fingerprints against expected pinsets for critical outbound integrations.
Monitoring Recommendations
- Enable TLS inspection or passive certificate logging on egress points to detect certificates that would fail hostname validation.
- Alert on new or unexpected certificate authorities appearing in traffic sourced from libcurl-linked services.
- Track the versions of curl and mbedTLS reported by NetApp HCI, storage nodes, and macOS endpoints against the fixed baselines.
How to Mitigate CVE-2024-2466
Immediate Actions Required
- Upgrade libcurl to a version that contains the fix documented in the curl project advisory.
- Apply Apple security updates referenced in HT214118, HT214119, and HT214120 to affected macOS systems.
- Apply NetApp fixes tracked in advisory ntap-20240503-0010 for HCI Compute Node, Bootstrap OS, and H-series storage node firmware.
Patch Information
The curl project released a patched version that restores the mbedtls_ssl_set_hostname call for IP-literal destinations, re-enabling certificate verification. Vendors that redistribute libcurl, including Apple and NetApp, have published backported updates. Rebuild any in-house software that statically links libcurl with mbedTLS against a fixed release.
Workarounds
- Switch the TLS backend used by libcurl from mbedTLS to OpenSSL, GnuTLS, or another unaffected backend where operationally feasible.
- Route TLS traffic through hostnames rather than IP addresses so downstream tooling exercises the SNI-enabled code path.
- Enforce certificate pinning at the application layer using CURLOPT_PINNEDPUBLICKEY for critical endpoints until patched builds are deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.