CVE-2024-2398
MediumSummary
A vulnerability in the libcurl library causes a memory leak when handling HTTP/2 server push. When an application allows server push and the number of headers exceeds the limit of 1000, libcurl aborts the push but fails to free previously allocated headers.
Risk Assessment
Memory leak can lead to gradual exhaustion of system resources, potentially causing a denial of service (DoS) for applications using libcurl.
Recommendation
It is recommended to update libcurl to a version that fixes this vulnerability. Consider temporarily disabling HTTP/2 server push if not required.
Original NVD description (English source)
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leak