QUIC certificate check bypass with wolfSSL
Priority LOW 32CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-295.
Summary
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01863 79th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 2 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| curl | curl | 8.6.0 – 8.6.0 | — | No fix listed | CNA |
- curl Vendorcurl Affected 8.6.0 – 8.6.0 Fixed in — No fix listed CNA
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:haxx:curl:8.6.0:*:*:*:*:*:*:* | 8.6.0 | Vulnerable | Haxx |
| cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* | before 12.7.6; 13.0 to before 13.6.8; 14.0 to before 14.6 | Vulnerable | Apple |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
- cpe:2.3:a:haxx:curl:8.6.0:*:*:*:*:*:*:* Versions 8.6.0 Vulnerable ·Haxx
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* Versions before 12.7.6; 13.0 to before 13.6.8; 14.0 to before 14.6 Vulnerable ·Apple
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
- cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Remediation
Red Hat 2 advisories
- RHSA-2024:2693 Released 2024-05-07 · Red Hat rating ModerateRed Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl-8.7.1-2.el7jbcs, jbcs-httpd24-httpd-2.4.57-10.el7jbcs, jbcs-httpd24-httpd-devel-2.4.57-10.el7jbcs +17
- Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-curl-8.7.1-2.el8jbcs, jbcs-httpd24-httpd-2.4.57-10.el8jbcs, jbcs-httpd24-httpd-devel-2.4.57-10.el8jbcs +17
- RHSA-2024:2694 Released 2024-05-07 · Red Hat rating ModerateRed Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update
- Red Hat JBoss Core Services
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Core Services | Fixed | RHSA-2024:2694 |
| Red Hat JBoss Core Services on RHEL 7 Server | Fixed | RHSA-2024:2693 |
| Red Hat JBoss Core Services on RHEL 8 | Fixed | RHSA-2024:2693 |
Not affected: 6 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2024-2379
- 2026-10-03 Alias added: GHSA-wr4c-gwg7-p734
- 2026-10-09 Fix available: RHSA-2024:2694 · Red Hat
- 2026-10-16 Fix available: Red Hat JBoss Core Services · Red Hat
References
Exploit 1
Advisory 10
- json
- www
- http://www.openwall.com/lists/oss-security/2024/03/27/2
- https://security.netapp.com/advisory/ntap-20240531-0001/
- https://support.apple.com/kb/HT214119
- https://support.apple.com/kb/HT214118
- https://support.apple.com/kb/HT214120
- http://seclists.org/fulldisclosure/2024/Jul/20
- http://seclists.org/fulldisclosure/2024/Jul/18
- http://seclists.org/fulldisclosure/2024/Jul/19
More curl vulnerabilities
- TI-2023-19922 Out-of-bounds write in curl CVSS 3.1CRITICAL 9.8
- TI-2026-16162 Negotiate ambient user conn reuse CVSS 3.1CRITICAL 9.8
- TI-2026-10231 cross-origin Digest auth state leak CVSS 3.1CRITICAL 9.8
- TI-2026-09063 HTTP/2 stream-dependency tree UAF CVSS 3.1CRITICAL 9.8
- TI-2026-07976 stale proxy password leak CVSS 3.1CRITICAL 9.8
- TI-2026-07845 SASL double-free CVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-2379 · CVE Program
- CVE-2024-2379 · NVD
- FIRST EPSS
- GHSA-wr4c-gwg7-p734 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-2379 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences