CVE-2024-6874
published 2024-07-24CVE-2024-6874: libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN. Asking to convert a name…
PriorityP425medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.99%
77.4th percentile
libcurl's URL API function
[curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode
conversions, to and from IDN. Asking to convert a name that is exactly 256
bytes, libcurl ends up reading outside of a stack based buffer when built to
use the *macidn* IDN backend. The conversion function then fills up the
provided buffer exactly - but does not null terminate the string.
This flaw can lead to stack contents accidently getting returned as part of
the converted string.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| curl | curl | 8.8.0 – 8.8.0 | — |
| debian | curl | < curl 8.9.0-1 (forky) | curl 8.9.0-1 (forky) |
| haxx | curl | >= 0 < 8.9.0-r0 | 8.9.0-r0 |
| haxx | curl | >= 0 < 8.9.0-r0 | 8.9.0-r0 |
| haxx | curl | >= 0 < 8.9.0-r0 | 8.9.0-r0 |
| haxx | curl | >= 0 < 8.9.0-r0 | 8.9.0-r0 |
| haxx | curl | >= 0 < 8.9.0-r0 | 8.9.0-r0 |
| haxx | curl | >= 0 < 8.9.0-r0 | 8.9.0-r0 |
| haxx | curl | >= 0 < 8.9.0-r0 | 8.9.0-r0 |
| haxx | curl | >= 0 < 8.9.0-1 | 8.9.0-1 |
| haxx | curl | >= 0 < 8.9.0-1 | 8.9.0-1 |
| haxx | libcurl | — | — |
| msrc | azl3_cmake_3.30.3-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_cmake_3.30.3-6_on_azure_linux_3.0 | — | — |
| msrc | azl3_curl_8.8.0-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_curl_8.8.0-4_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_curl_8.8.0-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_curl_8.8.0-6_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
osv4.3MEDIUM
vendor_debian4.3LOW
vendor_msrc4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
curl: macidn punycode buffer overread
vendor_redhat·2024-07-24·CVSS 4.3
CVE-2024-6874 [MEDIUM] CWE-126 curl: macidn punycode buffer overread
curl: macidn punycode buffer overread
libcurl's URL API function
[curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode
conversions, to and from IDN. Asking to convert a name that is exactly 256
bytes, libcurl ends up reading outside of a stack based buffer when built to
use the *macidn* IDN backend. The conversion function then fills up the
provided buffer exactly - but does not null terminate the string.
This flaw can lead to stack contents accidently getting returned as part of
the converted string.
A buffer overread vulnerability was found in Curl's URL API function curl_url_get(). This issue allows a remote attacker to obtain sensitive information due to a punycode buffer overread flaw. By sending a specially crafted request, an attacker can gain sensitive inf
Microsoft
macidn punycode buffer overread
vendor_msrc·2024-07-09·CVSS 4.3
CVE-2024-6874 [MEDIUM] CWE-125 macidn punycode buffer overread
macidn punycode buffer overread
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
curl: curl
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure
Debian
CVE-2024-6874: curl - libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_g...
vendor_debian·2024·CVSS 4.3
CVE-2024-6874 [MEDIUM] CVE-2024-6874: curl - libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_g...
libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the *macidn* IDN backend. The conversion function then fills up the provided buffer exactly - but does not null terminate the string. This flaw can lead to stack contents accidently getting returned as part of the converted string.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 8.9.0-1)
sid: resolved (fixed in 8.9.0-1)
trixie: resolved (fixed in 8.9.0-1)
OSV
CVE-2024-6874: libcurl's URL API function [curl_url_get()](https://curl
osv·2024-07-24·CVSS 4.3
CVE-2024-6874 [MEDIUM] CVE-2024-6874: libcurl's URL API function [curl_url_get()](https://curl
libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the *macidn* IDN backend. The conversion function then fills up the provided buffer exactly - but does not null terminate the string. This flaw can lead to stack contents accidently getting returned as part of the converted string.
GHSA
GHSA-chhh-4xrf-42pg: libcurl's URL API function
[curl_url_get()](https://curl
ghsa_unreviewed·2024-07-24
CVE-2024-6874 [LOW] CWE-125 GHSA-chhh-4xrf-42pg: libcurl's URL API function
[curl_url_get()](https://curl
libcurl's URL API function
[curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode
conversions, to and from IDN. Asking to convert a name that is exactly 256
bytes, libcurl ends up reading outside of a stack based buffer when built to
use the *macidn* IDN backend. The conversion function then fills up the
provided buffer exactly - but does not null terminate the string.
This flaw can lead to stack contents accidently getting returned as part of
the converted string.
OSV
CVE-2024-6874: libcurl's URL API function
[curl_url_get()](https://curl
osv·2024-07-24·CVSS 4.3
CVE-2024-6874 [MEDIUM] CVE-2024-6874: libcurl's URL API function
[curl_url_get()](https://curl
libcurl's URL API function
[curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode
conversions, to and from IDN. Asking to convert a name that is exactly 256
bytes, libcurl ends up reading outside of a stack based buffer when built to
use the *macidn* IDN backend. The conversion function then fills up the
provided buffer exactly - but does not null terminate the string.
This flaw can lead to stack contents accidently getting returned as part of
the converted string.
No detection rules found.
No public exploits indexed.
HackerOne
curl: stack-buffer overread during punycode conversions
hackerone·2024-09-22·CVSS 4.3
CVE-2024-6874 [MEDIUM] curl: stack-buffer overread during punycode conversions
curl: stack-buffer overread during punycode conversions
Hello, I would like to report a vulnerability here, initially reported by me to the curl project.
HackerOne report: https://hackerone.com/reports/2604391
CVE: CVE-2024-6874
Advisory: https://curl.se/docs/CVE-2024-6874.html
Severity: Low
## Impact
When converting the domain name of a URL from/to punycode with libcurl's URL API, libcurl reads past the bounds of a stack-buffer and includes
adjacent stack-memory in the conversion result. This potentially leaks pointer values.
libcurl's URL API function curl_url_get() offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the macidn IDN backend. The conversion function
Bugzilla
CVE-2024-6874 curl: macidn punycode buffer overread
bugzilla·2024-07-24·CVSS 4.3
CVE-2024-6874 [MEDIUM] CVE-2024-6874 curl: macidn punycode buffer overread
CVE-2024-6874 curl: macidn punycode buffer overread
libcurl's URL API function
[curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode
conversions, to and from IDN. Asking to convert a name that is exactly 256
bytes, libcurl ends up reading outside of a stack based buffer when built to
use the *macidn* IDN backend. The conversion function then fills up the
provided buffer exactly - but does not null terminate the string.
This flaw can lead to stack contents accidently getting returned as part of
the converted string.
Discussion:
From Advisory:
AFFECTED VERSIONS
The vulnerable code can only be reached when curl is built to use macidn, the native IDN conversion library bundled with Apple's operating systems: macOS, iOS, ipadOS etc. Builds using other IDN backends
HackerOne
CVE-2024-6874: macidn punycode buffer overread
hackerone·2024-07-24·CVSS 4.3
CVE-2024-6874 [MEDIUM] CVE-2024-6874: macidn punycode buffer overread
CVE-2024-6874: macidn punycode buffer overread
libcurl at commit [58772b0e082eda333e0a5fc8fb0bc7f17a3cd99c](https://github.com/curl/curl/tree/58772b0e082eda333e0a5fc8fb0bc7f17a3cd99c) contains a stack-buffer overread in [lib/idn.c:75](https://github.com/curl/curl/blob/58772b0e082eda333e0a5fc8fb0bc7f17a3cd99c/lib/idn.c#L75) that can be triggered when the host of a URL is converted to punycode.
The root cause of the bug is in the function `mac_idn_to_ascii()`:
```c
static CURLcode mac_idn_to_ascii(const char *in, char **out)
{
// --- snip ---
UIDNAInfo info = UIDNA_INFO_INITIALIZER;
char buffer[256] = {0};
(void)uidna_nameToASCII_UTF8(idna, in, -1, buffer,
sizeof(buffer), &info, &err);
uidna_close(idna);
if(U_FAILURE(err)) {
return CURLE_URL_MALFORMAT;
}
else {
*out = strdup(buffer);
if(*
http://www.openwall.com/lists/oss-security/2024/07/24/2https://curl.se/docs/CVE-2024-6874.htmlhttps://curl.se/docs/CVE-2024-6874.jsonhttps://hackerone.com/reports/2604391http://www.openwall.com/lists/oss-security/2024/07/24/2https://curl.se/docs/CVE-2024-6874.htmlhttps://curl.se/docs/CVE-2024-6874.jsonhttps://hackerone.com/reports/2604391https://security.netapp.com/advisory/ntap-20240822-0004/
2024-07-24
Published