PT-2024-7663 · Curl+9 · Curl+9
Daniel Stenberg
+1
·
Published
2024-10-09
·
Updated
2026-05-18
·
CVE-2024-9681
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
curl versions prior to 8.10.1
Description
The issue is related to the implementation of the HSTS (HTTP Strict Transport Security) mechanism in the curl utility. When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure
HTTP:// scheme and perform transfers with hosts like x.example.com as well as example.com where the first host is a subdomain of the second host. The result of a triggered bug is that HTTP accesses to example.com get converted to HTTPS for a different period of time than what was asked for by the origin server. If example.com for example stops supporting HTTPS at its expiry time, curl might then fail to access http://example.com until the (wrongly set) timeout expires. This bug can also expire the parent's entry earlier, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended.Recommendations
To resolve the issue, update curl to version 8.10.1 or later. As a temporary workaround, consider restricting the influence of subdomains on the HSTS cache of parent domains to minimize the risk of exploitation. Avoid using the
HTTP:// scheme for transfers with hosts that have subdomains, and instead use the HTTPS:// scheme to ensure secure connections.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Ibm Aix
Linuxmint
Apple Macos
Red Os
Suse
Ubuntu
Curl