VYPR
← All advisories
Unrated severityNVD Advisory· Published Mar 27, 2024· Updated Feb 13, 2025

HTTP/2 push headers memory-leak

CVE-2024-2398

Description

libcurl leaks memory when aborting HTTP/2 server push due to excessive headers, enabling potential denial of service via memory exhaustion.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

libcurl leaks memory when aborting HTTP/2 server push due to excessive headers, enabling potential denial of service via memory exhaustion.

Vulnerability

In libcurl, when an application enables HTTP/2 server push (via CURLOPT_PUSHFUNCTION), and the server sends a PUSH_PROMISE frame with more than 1000 headers, libcurl aborts the push but fails to free previously allocated header memory, resulting in a memory leak. This affects curl versions 7.44.0 through 8.6.0 built with HTTP/2 support [4].

Exploitation

An attacker controlling an HTTP/2 server can send a crafted push promise with an excessive number of headers to trigger the leak. The client application must have enabled HTTP/2 server push (not the default). No authentication or user interaction is required, and the error is silent, making detection difficult [4].

Impact

Repeated exploitation can exhaust the memory of the process using libcurl, leading to a denial of service. No other impacts (such as code execution or information disclosure) are described [4].

Mitigation

The vulnerability is fixed in curl version 8.7.0, released March 27, 2024. As a workaround, applications can disable HTTP/2 server push by returning CURL_PUSH_DENY from the push callback, or disable HTTP/2 entirely. Users should upgrade libcurl or apply the patch [4].

References
  1. security - [SECURITY ADVISORY] curl: CVE-2024-2398: HTTP/2 push headers memory-leak

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

43

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

13

News mentions

0

No linked articles in our index yet.