CVE catalog
CVE-2024-9681
curl vulnerability
When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.) When `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain's expiry timeout *bleed over* and get set for the parent domain `example.com` in curl's HSTS cache. The result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different period of time than what was asked for by the origin server. If `example.com` for example stops supporting HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set) timeout expires. This bug can also expire the parent's entry *earlier*, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended.
- Severity
- Medium · CVSS 6.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.99% · Oct 27, 2026
Projects and upstream resources
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
Version impact has not been established. The original provider fields are retained below.
Provider details and historical evidence
Original provider fields
{
"package_releases": [
{
"name": "curl",
"status": "fixed",
"release": "sid",
"version": "8.23.0-1"
},
{
"name": "curl",
"status": "fixed",
"release": "forky",
"version": "8.22.0-1"
},
{
"name": "curl",
"status": "fixed",
"release": "trixie",
"version": "8.14.1-2+deb13u5"
},
{
"name": "curl",
"status": "fixed",
"release": "trixie-security",
"version": "8.14.1-2+deb13u7"
},
{
"name": "curl",
"status": "fixed",
"release": "bookworm",
"version": "7.88.1-10+deb12u15"
},
{
"name": "curl",
"status": "vulnerable",
"release": "bookworm-security",
"version": "7.88.1-10+deb12u5"
}
],
"fixed_versions": [
{
"bug": 1086804,
"name": "curl",
"type": "source",
"origin": null,
"release": "sid",
"urgency": "not yet assigned",
"fixed_version": "8.11.0-1"
},
{
"bug": 1086804,
"name": "curl",
"type": "source",
"origin": null,
"release": "forky",
"urgency": "not yet assigned",
"fixed_version": "8.11.0-1"
},
{
"bug": 1086804,
"name": "curl",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "not yet assigned",
"fixed_version": "8.11.0-1"
},
{
"bug": 1086804,
"name": "curl",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "not yet assigned",
"fixed_version": "7.88.1-10+deb12u9"
}
],
"distribution_packages": [
{
"name": "curl",
"distro": "ubuntu",
"release": "noble",
"ecosystem": "deb",
"fixed_version": "7.88.1-10+deb12u9"
},
{
"name": "curl",
"distro": "ubuntu",
"release": "noble",
"ecosystem": "deb",
"fixed_version": "8.5.0-2ubuntu10.5"
},
{
"name": "libcurl3t64-gnutls",
"distro": "ubuntu",
"release": "noble",
"ecosystem": "deb",
"fixed_version": "8.5.0-2ubuntu10.5"
},
{
"name": "libcurl4-doc",
"distro": "ubuntu",
"release": "noble",
"ecosystem": "deb",
"fixed_version": "8.5.0-2ubuntu10.5"
},
{
"name": "libcurl4-gnutls-dev",
"distro": "ubuntu",
"release": "noble",
"ecosystem": "deb",
"fixed_version": "8.5.0-2ubuntu10.5"
},
{
"name": "libcurl4-openssl-dev",
"distro": "ubuntu",
"release": "noble",
"ecosystem": "deb",
"fixed_version": "8.5.0-2ubuntu10.5"
},
{
"name": "libcurl4t64",
"distro": "ubuntu",
"release": "noble",
"ecosystem": "deb",
"fixed_version": "8.5.0-2ubuntu10.5"
},
{
"name": "curl",
"distro": "alpine",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.74.0"
},
{
"fixed": "8.11.0-r0"
}
]
}
],
"release": "3.18",
"versions": [],
"ecosystem": "apk",
"fixed_version": "8.11.0-r0",
"provider_record_id": "ALPINE-CVE-2024-9681"
},
{
"name": "curl",
"distro": "alpine",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.74.0"
},
{
"fixed": "8.11.0-r0"
}
]
}
],
"release": "3.19",
"versions": [],
"ecosystem": "apk",
"fixed_version": "8.11.0-r0",
"provider_record_id": "ALPINE-CVE-2024-9681"
},
{
"name": "curl",
"distro": "alpine",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.74.0"
},
{
"fixed": "8.11.0-r0"
}
]
}
],
"release": "3.20",
"versions": [],
"ecosystem": "apk",
"fixed_version": "8.11.0-r0",
"provider_record_id": "ALPINE-CVE-2024-9681"
},
{
"name": "curl",
"distro": "alpine",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.74.0"
},
{
"fixed": "8.11.0-r0"
}
]
}
],
"release": "3.21",
"versions": [],
"ecosystem": "apk",
"fixed_version": "8.11.0-r0",
"provider_record_id": "ALPINE-CVE-2024-9681"
},
{
"name": "curl",
"distro": "alpine",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.74.0"
},
{
"fixed": "8.11.0-r0"
}
]
}
],
"release": "3.22",
"versions": [],
"ecosystem": "apk",
"fixed_version": "8.11.0-r0",
"provider_record_id": "ALPINE-CVE-2024-9681"
},
{
"name": "curl",
"distro": "alpine",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.74.0"
},
{
"fixed": "8.11.0-r0"
}
]
}
],
"release": "3.23",
"versions": [],
"ecosystem": "apk",
"fixed_version": "8.11.0-r0",
"provider_record_id": "ALPINE-CVE-2024-9681"
},
{
"name": "curl",
"distro": "alpine",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.74.0"
},
{
"fixed": "8.11.0-r0"
}
]
}
],
"release": "3.24",
"versions": [],
"ecosystem": "apk",
"fixed_version": "8.11.0-r0",
"provider_record_id": "ALPINE-CVE-2024-9681"
},
{
"name": "curl",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.81.0-1ubuntu1.19"
}
]
}
],
"release": "22.04",
"versions": [
"7.74.0-1.3ubuntu2",
"7.74.0-1.3ubuntu3",
"7.80.0-3",
"7.81.0-1",
"7.81.0-1ubuntu1.1",
"7.81.0-1ubuntu1.2",
"7.81.0-1ubuntu1.3",
"7.81.0-1ubuntu1.4",
"7.81.0-1ubuntu1.6",
"7.81.0-1ubuntu1.7",
"7.81.0-1ubuntu1.8",
"7.81.0-1ubuntu1.10",
"7.81.0-1ubuntu1.11",
"7.81.0-1ubuntu1.13",
"7.81.0-1ubuntu1.14",
"7.81.0-1ubuntu1.15",
"7.81.0-1ubuntu1.16",
"7.81.0-1ubuntu1.17",
"7.81.0-1ubuntu1.18"
],
"ecosystem": "deb",
"fixed_version": "7.81.0-1ubuntu1.19",
"provider_record_id": "UBUNTU-CVE-2024-9681"
},
{
"name": "curl",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.5.0-2ubuntu10.5"
}
]
}
],
"release": "24.04",
"versions": [
"8.2.1-1ubuntu3",
"8.2.1-1ubuntu3.1",
"8.4.0-2ubuntu1",
"8.5.0-2ubuntu1",
"8.5.0-2ubuntu2",
"8.5.0-2ubuntu8",
"8.5.0-2ubuntu9",
"8.5.0-2ubuntu10",
"8.5.0-2ubuntu10.1",
"8.5.0-2ubuntu10.2",
"8.5.0-2ubuntu10.3",
"8.5.0-2ubuntu10.4"
],
"ecosystem": "deb",
"fixed_version": "8.5.0-2ubuntu10.5",
"provider_record_id": "UBUNTU-CVE-2024-9681"
},
{
"name": "curl",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.81.0-1ubuntu1.19"
}
]
}
],
"release": "22.04",
"versions": [
"7.74.0-1.3ubuntu2",
"7.74.0-1.3ubuntu3",
"7.80.0-3",
"7.81.0-1",
"7.81.0-1ubuntu1.1",
"7.81.0-1ubuntu1.2",
"7.81.0-1ubuntu1.3",
"7.81.0-1ubuntu1.4",
"7.81.0-1ubuntu1.6",
"7.81.0-1ubuntu1.7",
"7.81.0-1ubuntu1.8",
"7.81.0-1ubuntu1.10",
"7.81.0-1ubuntu1.11",
"7.81.0-1ubuntu1.13",
"7.81.0-1ubuntu1.14",
"7.81.0-1ubuntu1.15",
"7.81.0-1ubuntu1.16",
"7.81.0-1ubuntu1.17",
"7.81.0-1ubuntu1.18"
],
"ecosystem": "deb",
"fixed_version": "7.81.0-1ubuntu1.19",
"provider_record_id": "USN-7104-1"
},
{
"name": "curl",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.5.0-2ubuntu10.5"
}
]
}
],
"release": "24.04",
"versions": [
"8.2.1-1ubuntu3",
"8.2.1-1ubuntu3.1",
"8.4.0-2ubuntu1",
"8.5.0-2ubuntu1",
"8.5.0-2ubuntu2",
"8.5.0-2ubuntu8",
"8.5.0-2ubuntu9",
"8.5.0-2ubuntu10",
"8.5.0-2ubuntu10.1",
"8.5.0-2ubuntu10.2",
"8.5.0-2ubuntu10.3",
"8.5.0-2ubuntu10.4"
],
"ecosystem": "deb",
"fixed_version": "8.5.0-2ubuntu10.5",
"provider_record_id": "USN-7104-1"
},
{
"name": "curl",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.6.0-4.1"
}
]
}
],
"release": "linux micro 6.0",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.6.0-4.1",
"provider_record_id": "SUSE-SU-2025:20083-1"
},
{
"name": "curl",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.1-11.98.1"
}
]
}
],
"release": "linux enterprise server 12 sp5-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.0.1-11.98.1",
"provider_record_id": "SUSE-SU-2024:3927-2"
},
{
"name": "curl",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.1-11.98.1"
}
]
}
],
"release": "linux enterprise server ltss extended security 12 sp5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.0.1-11.98.1",
"provider_record_id": "SUSE-SU-2024:3927-2"
},
{
"name": "curl",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.6.0-150600.4.12.1"
}
]
}
],
"release": "linux enterprise module for basesystem 15 sp6",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.6.0-150600.4.12.1",
"provider_record_id": "SUSE-SU-2024:3925-1"
},
{
"name": "curl",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.6.0-150600.4.12.1"
}
]
}
],
"release": "leap 15.6",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.6.0-150600.4.12.1",
"provider_record_id": "SUSE-SU-2024:3925-1"
},
{
"name": "curl",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.1-11.98.1"
}
]
}
],
"release": "linux enterprise server 12 sp5-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.0.1-11.98.1",
"provider_record_id": "SUSE-SU-2024:3927-1"
},
{
"name": "curl",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.1-11.98.1"
}
]
}
],
"release": "linux enterprise server ltss extended security 12 sp5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.0.1-11.98.1",
"provider_record_id": "SUSE-SU-2024:3927-1"
},
{
"name": "curl",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.11.0-1.1"
}
]
}
],
"release": "tumbleweed",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.11.0-1.1",
"provider_record_id": "OPENSUSE-SU-2024:14476-1"
},
{
"name": "curl",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.1-150400.5.56.1"
}
]
}
],
"release": "linux enterprise installer updates 15 sp4",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.0.1-150400.5.56.1",
"provider_record_id": "SUSE-SU-2024:3926-1"
},
{
"name": "curl",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.1-150400.5.56.1"
}
]
}
],
"release": "linux enterprise installer updates 15 sp5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.0.1-150400.5.56.1",
"provider_record_id": "SUSE-SU-2024:3926-1"
},
{
"name": "curl",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.1-150400.5.56.1"
}
]
}
],
"release": "linux enterprise micro 5.3",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.0.1-150400.5.56.1",
"provider_record_id": "SUSE-SU-2024:3926-1"
},
{
"name": "curl",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.1-150400.5.56.1"
}
]
}
],
"release": "linux enterprise micro 5.4",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.0.1-150400.5.56.1",
"provider_record_id": "SUSE-SU-2024:3926-1"
},
{
"name": "curl",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.1-150400.5.56.1"
}
]
}
],
"release": "linux enterprise micro 5.5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.0.1-150400.5.56.1",
"provider_record_id": "SUSE-SU-2024:3926-1"
},
{
"name": "curl",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.1-150400.5.56.1"
}
]
}
],
"release": "linux enterprise module for basesystem 15 sp5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.0.1-150400.5.56.1",
"provider_record_id": "SUSE-SU-2024:3926-1"
},
{
"name": "curl",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.1-150400.5.56.1"
}
]
}
],
"release": "linux enterprise high performance computing 15 sp4-espos",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.0.1-150400.5.56.1",
"provider_record_id": "SUSE-SU-2024:3926-1"
},
{
"name": "curl",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.1-150400.5.56.1"
}
]
}
],
"release": "linux enterprise high performance computing 15 sp4-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.0.1-150400.5.56.1",
"provider_record_id": "SUSE-SU-2024:3926-1"
},
{
"name": "curl",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.1-150400.5.56.1"
}
]
}
],
"release": "linux enterprise server 15 sp4-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.0.1-150400.5.56.1",
"provider_record_id": "SUSE-SU-2024:3926-1"
},
{
"name": "curl",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.1-150400.5.56.1"
}
]
}
],
"release": "linux enterprise server for sap applications 15 sp4",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.0.1-150400.5.56.1",
"provider_record_id": "SUSE-SU-2024:3926-1"
},
{
"name": "curl",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.1-150400.5.56.1"
}
]
}
],
"release": "manager proxy 4.3",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.0.1-150400.5.56.1",
"provider_record_id": "SUSE-SU-2024:3926-1"
},
{
"name": "curl",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.1-150400.5.56.1"
}
]
}
],
"release": "manager server 4.3",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.0.1-150400.5.56.1",
"provider_record_id": "SUSE-SU-2024:3926-1"
},
{
"name": "curl",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.1-150400.5.56.1"
}
]
}
],
"release": "leap micro 5.5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.0.1-150400.5.56.1",
"provider_record_id": "SUSE-SU-2024:3926-1"
},
{
"name": "curl",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.1-150400.5.56.1"
}
]
}
],
"release": "leap 15.5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "8.0.1-150400.5.56.1",
"provider_record_id": "SUSE-SU-2024:3926-1"
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [curl]Unknown
Details (6)
7.88.1-10+deb12u15· amd64 · bookwormFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u15· arm64 · bookwormFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· amd64 · bookworm-backportsFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· arm64 · bookworm-backportsFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u5· amd64 · bookworm-securityAffected · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u5· arm64 · bookworm-securityAffected · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
- [libcurl3-gnutls]Unknown
Source package: [curl]
Details (6)
7.88.1-10+deb12u15· amd64 · bookwormFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u15· arm64 · bookwormFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· amd64 · bookworm-backportsFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· arm64 · bookworm-backportsFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u5· amd64 · bookworm-securityAffected · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u5· arm64 · bookworm-securityAffected · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
- [libcurl3-nss]Unknown
Source package: [curl]
Details (4)
7.88.1-10+deb12u15· amd64 · bookwormFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u15· arm64 · bookwormFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u5· amd64 · bookworm-securityAffected · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u5· arm64 · bookworm-securityAffected · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
- [libcurl4]Unknown
Source package: [curl]
Details (6)
7.88.1-10+deb12u15· amd64 · bookwormFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u15· arm64 · bookwormFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· amd64 · bookworm-backportsFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· arm64 · bookworm-backportsFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u5· amd64 · bookworm-securityAffected · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u5· arm64 · bookworm-securityAffected · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
- [libcurl4-doc]Unknown
Source package: [curl]
Details (6)
7.88.1-10+deb12u15· all · bookwormFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u15· all · bookwormFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· all · bookworm-backportsFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· all · bookworm-backportsFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u5· all · bookworm-securityAffected · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u5· all · bookworm-securityAffected · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
- [libcurl4-gnutls-dev]Unknown
Source package: [curl]
Details (6)
7.88.1-10+deb12u15· amd64 · bookwormFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u15· arm64 · bookwormFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· amd64 · bookworm-backportsFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· arm64 · bookworm-backportsFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u5· amd64 · bookworm-securityAffected · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u5· arm64 · bookworm-securityAffected · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
- [libcurl4-nss-dev]Unknown
Source package: [curl]
Details (4)
7.88.1-10+deb12u15· amd64 · bookwormFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u15· arm64 · bookwormFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u5· amd64 · bookworm-securityAffected · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u5· arm64 · bookworm-securityAffected · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
- [libcurl4-openssl-dev]Unknown
Source package: [curl]
Details (6)
7.88.1-10+deb12u15· amd64 · bookwormFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u15· arm64 · bookwormFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· amd64 · bookworm-backportsFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· arm64 · bookworm-backportsFixed · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u5· amd64 · bookworm-securityAffected · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
7.88.1-10+deb12u5· arm64 · bookworm-securityAffected · Fixed:
7.88.1-10+deb12u9usn · curl · debian · bookworm; usn · curl · debian · 12
[Debian 13 (Trixie)]
- [curl]Unknown
Details (5)
8.14.1-2+deb13u4· amd64 · trixieFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.14.1-2+deb13u4· arm64 · trixieFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.21.0-2~bpo13+1· amd64 · trixie-backportsFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.21.0-2~bpo13+1· arm64 · trixie-backportsFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.14.1-2+deb13u7· amd64 · trixie-securityFixed · Fixed:
8.11.0-1usn · curl · debian · 13
- [libcurl3t64-gnutls]Unknown
Source package: [curl]
Details (5)
8.14.1-2+deb13u4· amd64 · trixieFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.14.1-2+deb13u4· arm64 · trixieFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.21.0-2~bpo13+1· amd64 · trixie-backportsFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.21.0-2~bpo13+1· arm64 · trixie-backportsFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.14.1-2+deb13u7· amd64 · trixie-securityFixed · Fixed:
8.11.0-1usn · curl · debian · 13
- [libcurl4-doc]Unknown
Source package: [curl]
Details (5)
8.14.1-2+deb13u4· all · trixieFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.14.1-2+deb13u4· all · trixieFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.21.0-2~bpo13+1· all · trixie-backportsFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.21.0-2~bpo13+1· all · trixie-backportsFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.14.1-2+deb13u7· all · trixie-securityFixed · Fixed:
8.11.0-1usn · curl · debian · 13
- [libcurl4-gnutls]Unknown
Source package: [curl]
Details (2)
8.21.0-2~bpo13+1· amd64 · trixie-backportsFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.21.0-2~bpo13+1· arm64 · trixie-backportsFixed · Fixed:
8.11.0-1usn · curl · debian · 13
- [libcurl4-gnutls-dev]Unknown
Source package: [curl]
Details (5)
8.14.1-2+deb13u4· amd64 · trixieFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.14.1-2+deb13u4· arm64 · trixieFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.21.0-2~bpo13+1· amd64 · trixie-backportsFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.21.0-2~bpo13+1· arm64 · trixie-backportsFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.14.1-2+deb13u7· amd64 · trixie-securityFixed · Fixed:
8.11.0-1usn · curl · debian · 13
- [libcurl4-openssl-dev]Unknown
Source package: [curl]
Details (5)
8.14.1-2+deb13u4· amd64 · trixieFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.14.1-2+deb13u4· arm64 · trixieFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.21.0-2~bpo13+1· amd64 · trixie-backportsFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.21.0-2~bpo13+1· arm64 · trixie-backportsFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.14.1-2+deb13u7· amd64 · trixie-securityFixed · Fixed:
8.11.0-1usn · curl · debian · 13
- [libcurl4t64]Unknown
Source package: [curl]
Details (5)
8.14.1-2+deb13u4· amd64 · trixieFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.14.1-2+deb13u4· arm64 · trixieFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.21.0-2~bpo13+1· amd64 · trixie-backportsFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.21.0-2~bpo13+1· arm64 · trixie-backportsFixed · Fixed:
8.11.0-1usn · curl · debian · 13
8.14.1-2+deb13u7· amd64 · trixie-securityFixed · Fixed:
8.11.0-1usn · curl · debian · 13
[openSUSE Tumbleweed]
- [curl]Unknown
Source package: [curl]
Details (1)
8.21.0-1.2· x86_64 · tumbleweedFixed · Fixed:
8.11.0-1.1usn · curl · opensuse · tumbleweed
- [curl-fish-completion]Unknown
Source package: [curl]
Details (1)
8.21.0-1.2· noarch · tumbleweedUnknown · Fixed:
8.11.0-1.1Version impact unknown
usn · curl · opensuse · tumbleweed
- [curl-zsh-completion]Unknown
Source package: [curl]
Details (1)
8.21.0-1.2· noarch · tumbleweedUnknown · Fixed:
8.11.0-1.1Version impact unknown
usn · curl · opensuse · tumbleweed
- [libcurl4]Unknown
Source package: [curl]
Details (1)
8.21.0-1.2· x86_64 · tumbleweedUnknown · Fixed:
8.11.0-1.1Version impact unknown
usn · curl · opensuse · tumbleweed
- [libcurl4-32bit]Unknown
Source package: [curl]
Details (1)
8.21.0-1.2· x86_64 · tumbleweedUnknown · Fixed:
8.11.0-1.1Version impact unknown
usn · curl · opensuse · tumbleweed
Observed:
References
- [https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json]
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2024_3925-1.json]
- [https://osv.dev/vulnerability/ALPINE-CVE-2024-9681]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2024-9681]
- [https://osv.dev/vulnerability/SUSE-SU-2024:3925-1]
- [https://osv.dev/vulnerability/SUSE-SU-2024:3926-1]
- [https://osv.dev/vulnerability/SUSE-SU-2024:3927-1]
- [https://osv.dev/vulnerability/SUSE-SU-2024:3927-2]
- [https://osv.dev/vulnerability/SUSE-SU-2025:20083-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2024-9681]
- [https://osv.dev/vulnerability/USN-7104-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:14476-1]
- [https://security-tracker.debian.org/tracker/CVE-2024-9681]
- [https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-9681.json]
- [https://ubuntu.com/security/notices/USN-7104-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-0668.json]
[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]