CVE catalog

CVE-2024-6197

curl: CVE-2024-6197

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: Jul 23, 2024, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 4.30% · Oct 25, 2026

libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags. The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	curl	sid	`8.23.0-1`	fixed
Debian	curl	forky	`8.22.0-1`	fixed
Debian	curl	trixie	`8.14.1-2+deb13u5`	fixed
Debian	curl	trixie-security	`8.14.1-2+deb13u7`	fixed
Debian	curl	bookworm	`7.88.1-10+deb12u15`	not affected
Debian	curl	bookworm-security	`7.88.1-10+deb12u5`	not affected
Alpine	curl	3.17	`8.9.0-r0`	fixed
Alpine	curl	3.18	`8.9.0-r0`	fixed
Alpine	curl	3.19	`8.9.0-r0`	fixed
Alpine	curl	3.20	`8.9.0-r0`	fixed
Alpine	curl	3.21	`8.9.0-r0`	fixed
Alpine	curl	3.22	`8.9.0-r0`	fixed
Alpine	curl	3.23	`8.9.0-r0`	fixed
Alpine	curl	3.24	`8.9.0-r0`	fixed
Opensuse	curl	tumbleweed	`8.9.0-1.1`	fixed
Suse	curl	linux enterprise module for basesystem 15 sp6	`8.6.0-150600.4.3.1`	fixed
Opensuse	curl	leap 15.6	`8.6.0-150600.4.3.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	curl	source	sid	`8.9.0-1`	not yet assigned	Not reported	[1076996]
Debian	curl	source	forky	`8.9.0-1`	not yet assigned	Not reported	[1076996]
Debian	curl	source	trixie	`8.9.0-1`	not yet assigned	Not reported	[1076996]
Debian	curl	source	bookworm	`Not affected`	unimportant	Not reported	[1076996]
Alpine	curl	apk	3.17	`8.9.0-r0`	Not reported	ALPINE-CVE-2024-6197	Not reported
Alpine	curl	apk	3.18	`8.9.0-r0`	Not reported	ALPINE-CVE-2024-6197	Not reported
Alpine	curl	apk	3.19	`8.9.0-r0`	Not reported	ALPINE-CVE-2024-6197	Not reported
Alpine	curl	apk	3.20	`8.9.0-r0`	Not reported	ALPINE-CVE-2024-6197	Not reported
Alpine	curl	apk	3.21	`8.9.0-r0`	Not reported	ALPINE-CVE-2024-6197	Not reported
Alpine	curl	apk	3.22	`8.9.0-r0`	Not reported	ALPINE-CVE-2024-6197	Not reported
Alpine	curl	apk	3.23	`8.9.0-r0`	Not reported	ALPINE-CVE-2024-6197	Not reported
Alpine	curl	apk	3.24	`8.9.0-r0`	Not reported	ALPINE-CVE-2024-6197	Not reported
Opensuse	curl	rpm	tumbleweed	`8.9.0-1.1`	Not reported	OPENSUSE-SU-2024:14225-1	Not reported
Suse	curl	rpm	linux enterprise module for basesystem 15 sp6	`8.6.0-150600.4.3.1`	Not reported	SUSE-SU-2024:2784-1	Not reported
Opensuse	curl	rpm	leap 15.6	`8.6.0-150600.4.3.1`	Not reported	SUSE-SU-2024:2784-1	Not reported

[Debian bug #1076996]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[curl]Unknown
Details (6)
- 7.88.1-10+deb12u15 · amd64 · bookworm
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u15 · arm64 · bookworm
  Not affected
  dsa · curl · debian · bookworm
- 8.14.1-2+deb13u2~bpo13+1 · amd64 · bookworm-backports
  Not affected
  dsa · curl · debian · bookworm
- 8.14.1-2+deb13u2~bpo13+1 · arm64 · bookworm-backports
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u5 · amd64 · bookworm-security
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u5 · arm64 · bookworm-security
  Not affected
  dsa · curl · debian · bookworm
[libcurl3-gnutls]Unknown
Source package: [curl]
Details (6)
- 7.88.1-10+deb12u15 · amd64 · bookworm
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u15 · arm64 · bookworm
  Not affected
  dsa · curl · debian · bookworm
- 8.14.1-2+deb13u2~bpo13+1 · amd64 · bookworm-backports
  Not affected
  dsa · curl · debian · bookworm
- 8.14.1-2+deb13u2~bpo13+1 · arm64 · bookworm-backports
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u5 · amd64 · bookworm-security
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u5 · arm64 · bookworm-security
  Not affected
  dsa · curl · debian · bookworm
[libcurl3-nss]Unknown
Source package: [curl]
Details (4)
- 7.88.1-10+deb12u15 · amd64 · bookworm
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u15 · arm64 · bookworm
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u5 · amd64 · bookworm-security
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u5 · arm64 · bookworm-security
  Not affected
  dsa · curl · debian · bookworm
[libcurl4]Unknown
Source package: [curl]
Details (6)
- 7.88.1-10+deb12u15 · amd64 · bookworm
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u15 · arm64 · bookworm
  Not affected
  dsa · curl · debian · bookworm
- 8.14.1-2+deb13u2~bpo13+1 · amd64 · bookworm-backports
  Not affected
  dsa · curl · debian · bookworm
- 8.14.1-2+deb13u2~bpo13+1 · arm64 · bookworm-backports
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u5 · amd64 · bookworm-security
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u5 · arm64 · bookworm-security
  Not affected
  dsa · curl · debian · bookworm
[libcurl4-doc]Unknown
Source package: [curl]
Details (6)
- 7.88.1-10+deb12u15 · all · bookworm
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u15 · all · bookworm
  Not affected
  dsa · curl · debian · bookworm
- 8.14.1-2+deb13u2~bpo13+1 · all · bookworm-backports
  Not affected
  dsa · curl · debian · bookworm
- 8.14.1-2+deb13u2~bpo13+1 · all · bookworm-backports
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u5 · all · bookworm-security
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u5 · all · bookworm-security
  Not affected
  dsa · curl · debian · bookworm
[libcurl4-gnutls-dev]Unknown
Source package: [curl]
Details (6)
- 7.88.1-10+deb12u15 · amd64 · bookworm
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u15 · arm64 · bookworm
  Not affected
  dsa · curl · debian · bookworm
- 8.14.1-2+deb13u2~bpo13+1 · amd64 · bookworm-backports
  Not affected
  dsa · curl · debian · bookworm
- 8.14.1-2+deb13u2~bpo13+1 · arm64 · bookworm-backports
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u5 · amd64 · bookworm-security
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u5 · arm64 · bookworm-security
  Not affected
  dsa · curl · debian · bookworm
[libcurl4-nss-dev]Unknown
Source package: [curl]
Details (4)
- 7.88.1-10+deb12u15 · amd64 · bookworm
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u15 · arm64 · bookworm
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u5 · amd64 · bookworm-security
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u5 · arm64 · bookworm-security
  Not affected
  dsa · curl · debian · bookworm
[libcurl4-openssl-dev]Unknown
Source package: [curl]
Details (6)
- 7.88.1-10+deb12u15 · amd64 · bookworm
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u15 · arm64 · bookworm
  Not affected
  dsa · curl · debian · bookworm
- 8.14.1-2+deb13u2~bpo13+1 · amd64 · bookworm-backports
  Not affected
  dsa · curl · debian · bookworm
- 8.14.1-2+deb13u2~bpo13+1 · arm64 · bookworm-backports
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u5 · amd64 · bookworm-security
  Not affected
  dsa · curl · debian · bookworm
- 7.88.1-10+deb12u5 · arm64 · bookworm-security
  Not affected
  dsa · curl · debian · bookworm

[Debian 13 (Trixie)]

[curl]Unknown
Details (5)
- 8.14.1-2+deb13u4 · amd64 · trixie
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.14.1-2+deb13u4 · arm64 · trixie
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.21.0-2~bpo13+1 · amd64 · trixie-backports
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.21.0-2~bpo13+1 · arm64 · trixie-backports
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.14.1-2+deb13u7 · amd64 · trixie-security
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
[libcurl3t64-gnutls]Unknown
Source package: [curl]
Details (5)
- 8.14.1-2+deb13u4 · amd64 · trixie
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.14.1-2+deb13u4 · arm64 · trixie
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.21.0-2~bpo13+1 · amd64 · trixie-backports
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.21.0-2~bpo13+1 · arm64 · trixie-backports
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.14.1-2+deb13u7 · amd64 · trixie-security
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
[libcurl4-doc]Unknown
Source package: [curl]
Details (5)
- 8.14.1-2+deb13u4 · all · trixie
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.14.1-2+deb13u4 · all · trixie
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.21.0-2~bpo13+1 · all · trixie-backports
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.21.0-2~bpo13+1 · all · trixie-backports
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.14.1-2+deb13u7 · all · trixie-security
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
[libcurl4-gnutls]Unknown
Source package: [curl]
Details (2)
- 8.21.0-2~bpo13+1 · amd64 · trixie-backports
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.21.0-2~bpo13+1 · arm64 · trixie-backports
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
[libcurl4-gnutls-dev]Unknown
Source package: [curl]
Details (5)
- 8.14.1-2+deb13u4 · amd64 · trixie
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.14.1-2+deb13u4 · arm64 · trixie
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.21.0-2~bpo13+1 · amd64 · trixie-backports
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.21.0-2~bpo13+1 · arm64 · trixie-backports
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.14.1-2+deb13u7 · amd64 · trixie-security
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
[libcurl4-openssl-dev]Unknown
Source package: [curl]
Details (5)
- 8.14.1-2+deb13u4 · amd64 · trixie
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.14.1-2+deb13u4 · arm64 · trixie
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.21.0-2~bpo13+1 · amd64 · trixie-backports
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.21.0-2~bpo13+1 · arm64 · trixie-backports
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.14.1-2+deb13u7 · amd64 · trixie-security
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
[libcurl4t64]Unknown
Source package: [curl]
Details (5)
- 8.14.1-2+deb13u4 · amd64 · trixie
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.14.1-2+deb13u4 · arm64 · trixie
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.21.0-2~bpo13+1 · amd64 · trixie-backports
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.21.0-2~bpo13+1 · arm64 · trixie-backports
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13
- 8.14.1-2+deb13u7 · amd64 · trixie-security
  Fixed · Fixed: 8.9.0-1
  dsa · curl · debian · 13

[openSUSE Tumbleweed]

[curl]Unknown
Source package: [curl]
Details (1)
- 8.21.0-1.2 · x86_64 · tumbleweed
  Fixed · Fixed: 8.9.0-1.1
  dsa · curl · opensuse · tumbleweed
[curl-fish-completion]Unknown
Source package: [curl]
Details (1)
- 8.21.0-1.2 · noarch · tumbleweed
  Unknown · Fixed: 8.9.0-1.1
  Version impact unknown
  dsa · curl · opensuse · tumbleweed
[curl-zsh-completion]Unknown
Source package: [curl]
Details (1)
- 8.21.0-1.2 · noarch · tumbleweed
  Unknown · Fixed: 8.9.0-1.1
  Version impact unknown
  dsa · curl · opensuse · tumbleweed
[libcurl4]Unknown
Source package: [curl]
Details (1)
- 8.21.0-1.2 · x86_64 · tumbleweed
  Unknown · Fixed: 8.9.0-1.1
  Version impact unknown
  dsa · curl · opensuse · tumbleweed
[libcurl4-32bit]Unknown
Source package: [curl]
Details (1)
- 8.21.0-1.2 · x86_64 · tumbleweed
  Unknown · Fixed: 8.9.0-1.1
  Version impact unknown
  dsa · curl · opensuse · tumbleweed

Next results

Observed: Oct 27, 2026, 2:58:31 AM UTC

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]