Libcurl Aborts Server Push Due to Memory Leak

CVE-2024-2398

What is CVE-2024-2398?

The vulnerability arises when applications using libcurl attempt to leverage HTTP/2 server push functionality and exceed the maximum header limit of 1000. In these instances, libcurl aborts the server push operation but fails to deallocate previously allocated headers, leading to unintentional memory leaks. This silent failure complicates detection, posing a risk for applications unaware of the potential memory consumption. Developers utilizing libcurl should assess their use of HTTP/2 server push and implement necessary mitigations to handle this vulnerability.

References