TI-2024-05746 Aliases CVE-2024-6197 GHSA-x3h8-3mf2-v794

freeing stack buffer in utf8asn1str

MEDIUM 46Published 2024-07-24 · Updated 2025-02-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags. The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.04296 91st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
curl	curl	8.8.0 – 8.8.0; 8.7.1 – 8.7.1; 8.7.0 – 8.7.0; 8.6.0 – 8.6.0	—	No fix listed	CNA

curl Vendorcurl Affected 8.8.0 – 8.8.0; 8.7.1 – 8.7.1; 8.7.0 – 8.7.0; 8.6.0 – 8.6.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:haxx:libcurl::::::::	8.6.0 to before 8.9.0	Vulnerable	Haxx

cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:* Versions 8.6.0 to before 8.9.0 Vulnerable ·Haxx

Remediation

Red Hat 1 advisory

RHSA-2025:3453 Released 2025-04-02 · Red Hat rating Important
Red Hat JBoss Core Services Apache HTTP Server 2.4.62 security update
- Red Hat JBoss Core Services 2.4.62

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat JBoss Core Services 2.4.62	Fixed	RHSA-2025:3453

Not affected: 6 products

Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat OpenShift Container Platform 4

Timeline

2026-10-02 Threatist record created from CVE-2024-6197
2026-10-03 Alias added: GHSA-x3h8-3mf2-v794
2026-10-07 Affected versions changed · Red Hat
2026-10-09 Fix available: RHSA-2025:3453 · Red Hat
2026-10-21 Fix available: Red Hat JBoss Core Services 2.4.62 · Red Hat

References

Exploit 1

issue

Advisory 4

TI-2023-19922 Out-of-bounds write in curl CVSS 3.1CRITICAL 9.8
TI-2026-16162 Negotiate ambient user conn reuse CVSS 3.1CRITICAL 9.8
TI-2026-10231 cross-origin Digest auth state leak CVSS 3.1CRITICAL 9.8
TI-2026-09063 HTTP/2 stream-dependency tree UAF CVSS 3.1CRITICAL 9.8
TI-2026-07976 stale proxy password leak CVSS 3.1CRITICAL 9.8
TI-2026-07845 SASL double-free CVSS 3.1CRITICAL 9.8

See all 103 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences