CVE-2024-9681Incorrect Comparison in Curl

Severity
6.5MEDIUMNVD
EPSS
0.7%
top 27.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 6
Latest updateApr 1

Description

When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previo

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:LExploitability: 2.2 | Impact: 4.2

Affected Packages4 packages

NVDhaxx/curl7.74.08.11.0
Alpinehaxx/curl< 8.11.0-r0+5
Debianhaxx/curl< 7.88.1-10+deb12u9+2
CVEListV5curl/curl8.10.18.10.1+36

Patches

🔴Vulnerability Details

4
OSV
CVE-2024-9681: When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than othe2024-11-06
GHSA
GHSA-g337-g667-mjvw: When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than othe2024-11-06
OSV
CVE-2024-9681: When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than othe2024-11-06
CVEList
HSTS subdomain overwrites parent cache entry2024-11-06

📋Vendor Advisories

12
Apple
CVE-2024-9681: watchOS 11.42025-04-01
Apple
CVE-2024-9681: macOS Sonoma 14.7.52025-03-31
Apple
CVE-2024-9681: iOS 18.4 and iPadOS 18.42025-03-31
Apple
CVE-2024-9681: tvOS 18.42025-03-31
Apple
CVE-2024-9681: macOS Ventura 13.7.52025-03-31

💬Community

1
HackerOne
CVE-2024-9681: HSTS subdomain overwrites parent cache entry2024-11-06
CVE-2024-9681 — Incorrect Comparison in Haxx Curl | cvebase