PT-2024-2663 · Libcurl+2 · Libcurl+2

Frank Yueh + 2 · Published 2024-03-14 · Updated 2026-05-18 · CVE-2024-2466

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions libcurl (affected versions not specified)

Description The issue is related to the implementation of TLS protocols in libcurl, where the server certificate is not checked when connecting to a host specified as an IP address, when built to use mbedTLS. This affects all uses of TLS protocols, including HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc. The vulnerability can be exploited by a remote attacker to conduct spoofing attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-297

Related Identifiers

AZL-37077

AZL-37103

AZL-42972

BDU:2024-02736

CLEANSTART-2026-AY18527

CLEANSTART-2026-BW46578

CLEANSTART-2026-DI23929

CLEANSTART-2026-LQ42192

CLEANSTART-2026-OF85770

CVE-2024-2466

JLSEC-2026-417

MGASA-2024-0099

OPENSUSE-SU-2024:13805-1

RHSA-2024:2693

SUSE-SU-2025:20029-1

Affected Products

Ibm Aix

Apple Macos

Libcurl

References · 325

• 🔥 https://hackerone.com/reports/2416725 · Exploit
• 🔥 https://vicarius.io/vsociety/posts/tls-certificate-check-bypass-curl-with-mbedtls-cve-2024-2466-2468 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-28321 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-27779 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-7264 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-0500 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-27781 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-27534 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22924 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-8169 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22925 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000257 · Security Note
• https://support.apple.com/kb/HT214119 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8619 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-0139 · Security Note