CURL-CVE-2024-2379

See a problem?
Please try reporting it to the source first.
Source
https://curl.se/docs/CVE-2024-2379.html
Import Source
https://curl.se/docs/CURL-CVE-2024-2379.json
JSON Data
https://api.osv.dev/v1/vulns/CURL-CVE-2024-2379
Aliases
Published
2024-03-27T08:00:00Z
Modified
2026-05-27T02:29:20Z
Summary
QUIC certificate check bypass with wolfSSL
Details

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

Database specific 
{
    "CWE":  {
        "desc":  "Improper Certificate Validation",
        "id":  "CWE-295"
    },
    "URL":  "https://curl.se/docs/CVE-2024-2379.json",
    "affects":  "both",
    "award":  {
        "amount":  "540",
        "currency":  "USD"
    },
    "issue":  "https://hackerone.com/reports/2410774",
    "last_affected":  "8.6.0",
    "package":  "curl",
    "severity":  "Low",
    "www":  "https://curl.se/docs/CVE-2024-2379.html"
}
Credits
    • Dexter Gerig - FINDER
    • Daniel Stenberg - REMEDIATION_DEVELOPER

Affected packages

Git / github.com/curl/curl.git

Affected ranges

Type
SEMVER
Events
Introduced
8.6.0
Fixed
8.7.0
Type
GIT
Repo
https://github.com/curl/curl.git
Events
Introduced
5d044ad9480a9f556f4b6a252d7533b1ba7fe57e
Fixed
aedbbdf18e689a5eee8dc39600914f5eda6c409c

Affected versions

8.*
8.6.0
Other
curl-8_6_0

Database specific

source 
"https://curl.se/docs/CURL-CVE-2024-2379.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "308331943041861371639039538192042483189",
            "length":  2335
        },
        "id":  "CURL-CVE-2024-2379-4dbeed5c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/aedbbdf18e689a5eee8dc39600914f5eda6c409c",
        "target":  {
            "file":  "lib/vquic/vquic-tls.c",
            "function":  "curl_wssl_init_ctx"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "304710802608863144525034776543861387669",
                "152849649950337135313138391605629341153",
                "87232486737253111567709053838971761644",
                "301176537118206019688446296485190556977",
                "227298720867210619994722286404526464743",
                "320580059432211571039891998163312159337",
                "126589234890986545332356183811704963214",
                "225157769788319158074990015026053240328",
                "217887743343146381480822658135552967292",
                "34586074150797236395501072178400680375",
                "8058249062824325069705209579206231951",
                "257931542921577543445064989776379055335",
                "319170056292468850829997776446338885613",
                "175102669095967882189577713037523353419",
                "28866816341477307423168021789210657964",
                "258973118936269985264340322446427215516"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2024-2379-5f54d04e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/aedbbdf18e689a5eee8dc39600914f5eda6c409c",
        "target":  {
            "file":  "lib/vquic/vquic-tls.c"
        }
    }
]
vanir_signatures_modified 
"2026-05-27T02:29:20Z"