PT-2024-2654 · Libcurl+2 · Libcurl+2

Daniel Stenberg + 2 · Published 2024-03-10 · Updated 2026-06-05 · CVE-2024-2379

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions libcurl versions (affected versions not specified)

Description The issue is related to libcurl skipping certificate verification for a QUIC connection under certain conditions when built to use wolfSSL. If an unknown or bad cipher or curve is used, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems. This could allow a remote attacker to ignore any certificate issues.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

AZL-42966

BDU:2024-02721

CLEANSTART-2026-AY18527

CLEANSTART-2026-BW46578

CLEANSTART-2026-DI23929

CLEANSTART-2026-LQ42192

CLEANSTART-2026-OF85770

CVE-2024-2379

ECHO-B0DE-6C4F-E1FD

JLSEC-2026-415

MGASA-2024-0099

OPENSUSE-SU-2024:13805-1

RHSA-2024:2693

SUSE-SU-2025:20029-1

Affected Products

Debian

Apple Macos

Libcurl

References · 320

• 🔥 https://hackerone.com/reports/2410774 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-16842 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000099 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-2004 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-0167 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-0853 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-11053 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2024-2379 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38545 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-6874 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-16840 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:20029-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5025 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-2379 · Vendor Advisory
• https://curl.se/docs/CVE-2024-2379.json · Vendor Advisory