Vulnerability-Lookup

CVE-2024-9681 (GCVE-0-2024-9681)

Vulnerability from cvelistv5 – Published: 2024-11-06 07:47 – Updated: 2025-11-03 20:56

Title

HSTS subdomain overwrites parent cache entry

Summary

When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.) When `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain's expiry timeout *bleed over* and get set for the parent domain `example.com` in curl's HSTS cache. The result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different period of time than what was asked for by the origin server. If `example.com` for example stops supporting HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set) timeout expires. This bug can also expire the parent's entry *earlier*, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-06 16:16 UTC

CWE

CWE-1025 Comparison Using Wrong Factors

Assigner

curl CNA under the redhat root

CNA scorecard D 46/100 over 51 records in the last 180 days details

References

13 references

URL	Tags
https://curl.se/docs/CVE-2024-9681.json
https://curl.se/docs/CVE-2024-9681.html
https://hackerone.com/reports/2764830
http://www.openwall.com/lists/oss-security/2024/11/06/2
https://security.netapp.com/advisory/ntap-2024121…
http://seclists.org/fulldisclosure/2025/Apr/13
http://seclists.org/fulldisclosure/2025/Apr/10
http://seclists.org/fulldisclosure/2025/Apr/9
http://seclists.org/fulldisclosure/2025/Apr/8
http://seclists.org/fulldisclosure/2025/Apr/5
http://seclists.org/fulldisclosure/2025/Apr/4
http://seclists.org/fulldisclosure/2025/Apr/12
http://seclists.org/fulldisclosure/2025/Apr/11

Impacted products

2 products

Vendor	Product	Version	CPE status
curl	curl	Affected: 8.10.1 , ≤ 8.10.1 (semver) Affected: 8.10.0 , ≤ 8.10.0 (semver) Affected: 8.9.1 , ≤ 8.9.1 (semver) Affected: 8.9.0 , ≤ 8.9.0 (semver) Affected: 8.8.0 , ≤ 8.8.0 (semver) Affected: 8.7.1 , ≤ 8.7.1 (semver) Affected: 8.7.0 , ≤ 8.7.0 (semver) Affected: 8.6.0 , ≤ 8.6.0 (semver) Affected: 8.5.0 , ≤ 8.5.0 (semver) Affected: 8.4.0 , ≤ 8.4.0 (semver) Affected: 8.3.0 , ≤ 8.3.0 (semver) Affected: 8.2.1 , ≤ 8.2.1 (semver) Affected: 8.2.0 , ≤ 8.2.0 (semver) Affected: 8.1.2 , ≤ 8.1.2 (semver) Affected: 8.1.1 , ≤ 8.1.1 (semver) Affected: 8.1.0 , ≤ 8.1.0 (semver) Affected: 8.0.1 , ≤ 8.0.1 (semver) Affected: 8.0.0 , ≤ 8.0.0 (semver) Affected: 7.88.1 , ≤ 7.88.1 (semver) Affected: 7.88.0 , ≤ 7.88.0 (semver) Affected: 7.87.0 , ≤ 7.87.0 (semver) Affected: 7.86.0 , ≤ 7.86.0 (semver) Affected: 7.85.0 , ≤ 7.85.0 (semver) Affected: 7.84.0 , ≤ 7.84.0 (semver) Affected: 7.83.1 , ≤ 7.83.1 (semver) Affected: 7.83.0 , ≤ 7.83.0 (semver) Affected: 7.82.0 , ≤ 7.82.0 (semver) Affected: 7.81.0 , ≤ 7.81.0 (semver) Affected: 7.80.0 , ≤ 7.80.0 (semver) Affected: 7.79.1 , ≤ 7.79.1 (semver) Affected: 7.79.0 , ≤ 7.79.0 (semver) Affected: 7.78.0 , ≤ 7.78.0 (semver) Affected: 7.77.0 , ≤ 7.77.0 (semver) Affected: 7.76.1 , ≤ 7.76.1 (semver) Affected: 7.76.0 , ≤ 7.76.0 (semver) Affected: 7.75.0 , ≤ 7.75.0 (semver) Affected: 7.74.0 , ≤ 7.74.0 (semver)	guessed
curl	curl	Unaffected: 0 , < 7.74.0 (semver) Affected: 7.74.0 , ≤ 8.10.1 (semver) Unaffected: 8.11.0 , < * (semver) cpe:2.3:a:curl:curl::::::::

Credits

newfunction Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:56:39.087Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/11/06/2"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241213-0006/"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2025/Apr/13"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2025/Apr/10"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2025/Apr/9"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2025/Apr/8"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2025/Apr/5"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2025/Apr/4"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2025/Apr/12"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2025/Apr/11"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:curl:curl:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "curl",
            "vendor": "curl",
            "versions": [
              {
                "lessThan": "7.74.0",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "8.10.1",
                "status": "affected",
                "version": "7.74.0",
                "versionType": "semver"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8.11.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-9681",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T16:16:59.652768Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T17:09:00.777Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThanOrEqual": "8.10.1",
              "status": "affected",
              "version": "8.10.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.0",
              "status": "affected",
              "version": "8.10.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.9.1",
              "status": "affected",
              "version": "8.9.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.9.0",
              "status": "affected",
              "version": "8.9.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.8.0",
              "status": "affected",
              "version": "8.8.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.7.1",
              "status": "affected",
              "version": "8.7.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.7.0",
              "status": "affected",
              "version": "8.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.6.0",
              "status": "affected",
              "version": "8.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.0",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.4.0",
              "status": "affected",
              "version": "8.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.3.0",
              "status": "affected",
              "version": "8.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.2.1",
              "status": "affected",
              "version": "8.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.2.0",
              "status": "affected",
              "version": "8.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.2",
              "status": "affected",
              "version": "8.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.1",
              "status": "affected",
              "version": "8.1.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.0",
              "status": "affected",
              "version": "8.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.0.1",
              "status": "affected",
              "version": "8.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.0.0",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.88.1",
              "status": "affected",
              "version": "7.88.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.88.0",
              "status": "affected",
              "version": "7.88.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.87.0",
              "status": "affected",
              "version": "7.87.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.86.0",
              "status": "affected",
              "version": "7.86.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.85.0",
              "status": "affected",
              "version": "7.85.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.84.0",
              "status": "affected",
              "version": "7.84.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.83.1",
              "status": "affected",
              "version": "7.83.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.83.0",
              "status": "affected",
              "version": "7.83.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.82.0",
              "status": "affected",
              "version": "7.82.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.81.0",
              "status": "affected",
              "version": "7.81.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.80.0",
              "status": "affected",
              "version": "7.80.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.79.1",
              "status": "affected",
              "version": "7.79.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.79.0",
              "status": "affected",
              "version": "7.79.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.78.0",
              "status": "affected",
              "version": "7.78.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.77.0",
              "status": "affected",
              "version": "7.77.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.76.1",
              "status": "affected",
              "version": "7.76.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.76.0",
              "status": "affected",
              "version": "7.76.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.75.0",
              "status": "affected",
              "version": "7.75.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.74.0",
              "status": "affected",
              "version": "7.74.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "newfunction"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain\u0027s cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain\u0027s expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl\u0027s HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent\u0027s entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1025 Comparison Using Wrong Factors",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-06T07:47:20.162Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "name": "json",
          "url": "https://curl.se/docs/CVE-2024-9681.json"
        },
        {
          "name": "www",
          "url": "https://curl.se/docs/CVE-2024-9681.html"
        },
        {
          "name": "issue",
          "url": "https://hackerone.com/reports/2764830"
        }
      ],
      "title": "HSTS subdomain overwrites parent cache entry"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2024-9681",
    "datePublished": "2024-11-06T07:47:20.162Z",
    "dateReserved": "2024-10-09T07:57:47.318Z",
    "dateUpdated": "2025-11-03T20:56:39.087Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-9681",
      "date": "2026-11-11",
      "epss": "0.01987",
      "percentile": "0.80878"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T01:17:56.000Z",
      "cve": "CVE-2024-9681",
      "id": "msrc_CVE-2024-9681",
      "initial_release_date": "2024-11-02T00:00:00.000Z",
      "product_status:fixed": "15",
      "product_status:known_affected": "15",
      "product_status:known_not_affected": "4",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "HSTS subdomain overwrites parent cache entry",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-9681.json",
      "version": "7"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "curl",
                "vendor": "curl",
                "versions": [
                  {
                    "lessThanOrEqual": "8.10.1",
                    "status": "affected",
                    "version": "8.10.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.10.0",
                    "status": "affected",
                    "version": "8.10.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.9.1",
                    "status": "affected",
                    "version": "8.9.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.9.0",
                    "status": "affected",
                    "version": "8.9.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.8.0",
                    "status": "affected",
                    "version": "8.8.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.7.1",
                    "status": "affected",
                    "version": "8.7.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.7.0",
                    "status": "affected",
                    "version": "8.7.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.6.0",
                    "status": "affected",
                    "version": "8.6.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.5.0",
                    "status": "affected",
                    "version": "8.5.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.4.0",
                    "status": "affected",
                    "version": "8.4.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.3.0",
                    "status": "affected",
                    "version": "8.3.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.2.1",
                    "status": "affected",
                    "version": "8.2.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.2.0",
                    "status": "affected",
                    "version": "8.2.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.1.2",
                    "status": "affected",
                    "version": "8.1.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.1.1",
                    "status": "affected",
                    "version": "8.1.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.1.0",
                    "status": "affected",
                    "version": "8.1.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.0.1",
                    "status": "affected",
                    "version": "8.0.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.0.0",
                    "status": "affected",
                    "version": "8.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.88.1",
                    "status": "affected",
                    "version": "7.88.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.88.0",
                    "status": "affected",
                    "version": "7.88.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.87.0",
                    "status": "affected",
                    "version": "7.87.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.86.0",
                    "status": "affected",
                    "version": "7.86.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.85.0",
                    "status": "affected",
                    "version": "7.85.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.84.0",
                    "status": "affected",
                    "version": "7.84.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.83.1",
                    "status": "affected",
                    "version": "7.83.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.83.0",
                    "status": "affected",
                    "version": "7.83.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.82.0",
                    "status": "affected",
                    "version": "7.82.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.81.0",
                    "status": "affected",
                    "version": "7.81.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.80.0",
                    "status": "affected",
                    "version": "7.80.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.79.1",
                    "status": "affected",
                    "version": "7.79.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.79.0",
                    "status": "affected",
                    "version": "7.79.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.78.0",
                    "status": "affected",
                    "version": "7.78.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.77.0",
                    "status": "affected",
                    "version": "7.77.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.76.1",
                    "status": "affected",
                    "version": "7.76.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.76.0",
                    "status": "affected",
                    "version": "7.76.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.75.0",
                    "status": "affected",
                    "version": "7.75.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.74.0",
                    "status": "affected",
                    "version": "7.74.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:curl:curl:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "curl",
                "vendor": "curl",
                "versions": [
                  {
                    "lessThan": "7.74.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.10.1",
                    "status": "affected",
                    "version": "7.74.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "8.11.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D26CBA59-021E-46CB-A1A0-5AD682F6685E",
                    "versionEndExcluding": "8.11.0",
                    "versionStartIncluding": "7.74.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain\u0027s cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain\u0027s expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl\u0027s HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent\u0027s entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended."
          },
          {
            "lang": "es",
            "value": "Cuando se le pide a curl que use HSTS, el tiempo de expiraci\u00f3n de un subdominio puede sobrescribir la entrada de cach\u00e9 de un dominio principal, lo que hace que finalice antes o despu\u00e9s de lo previsto. Esto afecta a curl que usa aplicaciones que habilitan HSTS y usan URL con el esquema inseguro `HTTP://` y realizan transferencias con hosts como `x.example.com` as\u00ed como `example.com` donde el primer host es un subdominio del segundo host. (El cach\u00e9 HSTS debe haberse llenado manualmente o debe haber habido accesos HTTPS previos ya que el cach\u00e9 debe tener entradas para los dominios involucrados para activar este problema). Cuando `x.example.com` responde con encabezados `Strict-Transport-Security:`, este error puede hacer que el tiempo de expiraci\u00f3n del subdominio *se extienda* y se configure para el dominio principal `example.com` en el cach\u00e9 HSTS de curl. El resultado de un error activado es que los accesos HTTP a `example.com` se convierten a HTTPS durante un per\u00edodo de tiempo diferente al solicitado por el servidor de origen. Si `example.com`, por ejemplo, deja de admitir HTTPS en su momento de vencimiento, curl podr\u00eda entonces no poder acceder a `http://example.com` hasta que expire el tiempo de espera (configurado incorrectamente). Este error tambi\u00e9n puede hacer que la entrada principal expire *antes*, lo que hace que curl vuelva inadvertidamente a HTTP inseguro antes de lo previsto."
          }
        ],
        "id": "CVE-2024-9681",
        "lastModified": "2026-06-17T08:25:03.177",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 4.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-9681",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T16:16:59.652768Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-11-06T08:15:03.740",
        "references": [
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://curl.se/docs/CVE-2024-9681.html"
          },
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://curl.se/docs/CVE-2024-9681.json"
          },
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "tags": [
              "Exploit",
              "Issue Tracking",
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://hackerone.com/reports/2764830"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://seclists.org/fulldisclosure/2025/Apr/10"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://seclists.org/fulldisclosure/2025/Apr/11"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://seclists.org/fulldisclosure/2025/Apr/12"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://seclists.org/fulldisclosure/2025/Apr/13"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://seclists.org/fulldisclosure/2025/Apr/4"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://seclists.org/fulldisclosure/2025/Apr/5"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://seclists.org/fulldisclosure/2025/Apr/8"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://seclists.org/fulldisclosure/2025/Apr/9"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Patch",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/11/06/2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://security.netapp.com/advisory/ntap-20241213-0006/"
          }
        ],
        "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-697"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-11-07T10:46:49+00:00",
      "cve": "CVE-2024-9681",
      "id": "CVE-2024-9681",
      "initial_release_date": "2024-11-06T00:00:00+00:00",
      "product_status:known_affected": "9",
      "product_status:known_not_affected": "29",
      "product_status:under_investigation": "12",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "curl: HSTS subdomain overwrites parent cache entry",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-9681.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T20:56:39.087Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "http://www.openwall.com/lists/oss-security/2024/11/06/2"
              },
              {
                "url": "https://security.netapp.com/advisory/ntap-20241213-0006/"
              },
              {
                "url": "http://seclists.org/fulldisclosure/2025/Apr/13"
              },
              {
                "url": "http://seclists.org/fulldisclosure/2025/Apr/10"
              },
              {
                "url": "http://seclists.org/fulldisclosure/2025/Apr/9"
              },
              {
                "url": "http://seclists.org/fulldisclosure/2025/Apr/8"
              },
              {
                "url": "http://seclists.org/fulldisclosure/2025/Apr/5"
              },
              {
                "url": "http://seclists.org/fulldisclosure/2025/Apr/4"
              },
              {
                "url": "http://seclists.org/fulldisclosure/2025/Apr/12"
              },
              {
                "url": "http://seclists.org/fulldisclosure/2025/Apr/11"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:curl:curl:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "curl",
                "vendor": "curl",
                "versions": [
                  {
                    "lessThan": "7.74.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.10.1",
                    "status": "affected",
                    "version": "7.74.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "8.11.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "HIGH",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 5.9,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-9681",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-11-06T16:16:59.652768Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-11-06T16:17:14.568Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "curl",
              "vendor": "curl",
              "versions": [
                {
                  "lessThanOrEqual": "8.10.1",
                  "status": "affected",
                  "version": "8.10.1",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "8.10.0",
                  "status": "affected",
                  "version": "8.10.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "8.9.1",
                  "status": "affected",
                  "version": "8.9.1",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "8.9.0",
                  "status": "affected",
                  "version": "8.9.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "8.8.0",
                  "status": "affected",
                  "version": "8.8.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "8.7.1",
                  "status": "affected",
                  "version": "8.7.1",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "8.7.0",
                  "status": "affected",
                  "version": "8.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "8.6.0",
                  "status": "affected",
                  "version": "8.6.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "8.5.0",
                  "status": "affected",
                  "version": "8.5.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "8.4.0",
                  "status": "affected",
                  "version": "8.4.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "8.3.0",
                  "status": "affected",
                  "version": "8.3.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "8.2.1",
                  "status": "affected",
                  "version": "8.2.1",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "8.2.0",
                  "status": "affected",
                  "version": "8.2.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "8.1.2",
                  "status": "affected",
                  "version": "8.1.2",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "8.1.1",
                  "status": "affected",
                  "version": "8.1.1",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "8.1.0",
                  "status": "affected",
                  "version": "8.1.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "8.0.1",
                  "status": "affected",
                  "version": "8.0.1",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "8.0.0",
                  "status": "affected",
                  "version": "8.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.88.1",
                  "status": "affected",
                  "version": "7.88.1",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.88.0",
                  "status": "affected",
                  "version": "7.88.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.87.0",
                  "status": "affected",
                  "version": "7.87.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.86.0",
                  "status": "affected",
                  "version": "7.86.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.85.0",
                  "status": "affected",
                  "version": "7.85.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.84.0",
                  "status": "affected",
                  "version": "7.84.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.83.1",
                  "status": "affected",
                  "version": "7.83.1",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.83.0",
                  "status": "affected",
                  "version": "7.83.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.82.0",
                  "status": "affected",
                  "version": "7.82.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.81.0",
                  "status": "affected",
                  "version": "7.81.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.80.0",
                  "status": "affected",
                  "version": "7.80.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.79.1",
                  "status": "affected",
                  "version": "7.79.1",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.79.0",
                  "status": "affected",
                  "version": "7.79.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.78.0",
                  "status": "affected",
                  "version": "7.78.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.77.0",
                  "status": "affected",
                  "version": "7.77.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.76.1",
                  "status": "affected",
                  "version": "7.76.1",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.76.0",
                  "status": "affected",
                  "version": "7.76.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.75.0",
                  "status": "affected",
                  "version": "7.75.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.74.0",
                  "status": "affected",
                  "version": "7.74.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "newfunction"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Daniel Stenberg"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain\u0027s cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain\u0027s expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl\u0027s HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent\u0027s entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-1025 Comparison Using Wrong Factors",
                  "lang": "en"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-11-06T07:47:20.162Z",
            "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "shortName": "curl"
          },
          "references": [
            {
              "name": "json",
              "url": "https://curl.se/docs/CVE-2024-9681.json"
            },
            {
              "name": "www",
              "url": "https://curl.se/docs/CVE-2024-9681.html"
            },
            {
              "name": "issue",
              "url": "https://hackerone.com/reports/2764830"
            }
          ],
          "title": "HSTS subdomain overwrites parent cache entry"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "assignerShortName": "curl",
        "cveId": "CVE-2024-9681",
        "datePublished": "2024-11-06T07:47:20.162Z",
        "dateReserved": "2024-10-09T07:57:47.318Z",
        "dateUpdated": "2025-11-03T20:56:39.087Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

NCSC-2025-0102

Vulnerability from csaf_ncscnl - Published: 2025-04-01 08:41 - Updated: 2025-04-01 08:41

Summary

Kwetsbaarheden verholpen in Apple macOS

Scope

137 vulnerabilities in this advisory, including CVE-2024-9681.

CVE-2024-9681

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

Known affected: 24 products

Open the full advisory

NCSC-2025-0103

Vulnerability from csaf_ncscnl - Published: 2025-04-01 08:42 - Updated: 2025-04-01 08:42

Summary

Kwetsbaarheden verholpen in Apple iOS en iPadOS

Scope

72 vulnerabilities in this advisory, including CVE-2024-9681.

CVE-2024-9681

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

Known affected: 46 products

Open the full advisory

OESA-2024-2388 (CVE-2024-9681)

Vulnerability from osv_openeuler – Published: 2024-11-15 11:07 – Updated: 2026-08-06 11:07 – Source website

Summary

curl security update

Details

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure HTTP:// scheme and perform transfers with hosts like x.example.com as well as example.com where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.) When x.example.com responds with Strict-Transport-Security: headers, this bug can make the subdomain's expiry timeout bleed over and get set for the parent domain example.com in curl's HSTS cache. The result of a triggered bug is that HTTP accesses to example.com get converted to HTTPS for a different period of time than what was asked for by the origin server. If example.com for example stops supporting HTTPS at its expiry time, curl might then fail to access http://example.com until the (wrongly set) timeout expires. This bug can also expire the parent's entry earlier, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended.(CVE-2024-9681)

Severity

5.9 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-9681	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "curl-7.79.1-33.oe2203sp1.aarch64.rpm",
          "curl-debuginfo-7.79.1-33.oe2203sp1.aarch64.rpm",
          "curl-debugsource-7.79.1-33.oe2203sp1.aarch64.rpm",
          "libcurl-7.79.1-33.oe2203sp1.aarch64.rpm",
          "libcurl-devel-7.79.1-33.oe2203sp1.aarch64.rpm"
        ],
        "noarch": [
          "curl-help-7.79.1-33.oe2203sp1.noarch.rpm"
        ],
        "src": [
          "curl-7.79.1-33.oe2203sp1.src.rpm"
        ],
        "x86_64": [
          "curl-7.79.1-33.oe2203sp1.x86_64.rpm",
          "curl-debuginfo-7.79.1-33.oe2203sp1.x86_64.rpm",
          "curl-debugsource-7.79.1-33.oe2203sp1.x86_64.rpm",
          "libcurl-7.79.1-33.oe2203sp1.x86_64.rpm",
          "libcurl-devel-7.79.1-33.oe2203sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP1",
        "name": "curl",
        "purl": "pkg:rpm/openEuler/curl\u0026distro=openEuler-22.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.79.1-33.oe2203sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\r\n\r\nWhen curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain\u0026apos;s cache entry, making it end sooner or later than otherwise intended.  This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host.  (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.)  When `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain\u0026apos;s expiry timeout *bleed over* and get set for the parent domain `example.com` in curl\u0026apos;s HSTS cache.  The result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different period of time than what was asked for by the origin server. If `example.com` for example stops supporting HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set) timeout expires. This bug can also expire the parent\u0026apos;s entry *earlier*, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended.(CVE-2024-9681)",
  "id": "OESA-2024-2388",
  "modified": "2026-08-06T11:07:51Z",
  "published": "2024-11-15T11:07:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2388"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9681"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "curl security update",
  "upstream": [
    "CVE-2024-9681"
  ]
}

OESA-2024-2389 (CVE-2024-9681)

Vulnerability from osv_openeuler – Published: 2024-11-15 11:07 – Updated: 2026-08-06 11:07 – Source website

Summary

curl security update

Details

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure HTTP:// scheme and perform transfers with hosts like x.example.com as well as example.com where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.) When x.example.com responds with Strict-Transport-Security: headers, this bug can make the subdomain's expiry timeout bleed over and get set for the parent domain example.com in curl's HSTS cache. The result of a triggered bug is that HTTP accesses to example.com get converted to HTTPS for a different period of time than what was asked for by the origin server. If example.com for example stops supporting HTTPS at its expiry time, curl might then fail to access http://example.com until the (wrongly set) timeout expires. This bug can also expire the parent's entry earlier, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended.(CVE-2024-9681)

Severity

5.9 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-9681	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "curl-8.4.0-11.oe2403.aarch64.rpm",
          "curl-debuginfo-8.4.0-11.oe2403.aarch64.rpm",
          "curl-debugsource-8.4.0-11.oe2403.aarch64.rpm",
          "libcurl-8.4.0-11.oe2403.aarch64.rpm",
          "libcurl-devel-8.4.0-11.oe2403.aarch64.rpm"
        ],
        "noarch": [
          "curl-help-8.4.0-11.oe2403.noarch.rpm"
        ],
        "src": [
          "curl-8.4.0-11.oe2403.src.rpm"
        ],
        "x86_64": [
          "curl-8.4.0-11.oe2403.x86_64.rpm",
          "curl-debuginfo-8.4.0-11.oe2403.x86_64.rpm",
          "curl-debugsource-8.4.0-11.oe2403.x86_64.rpm",
          "libcurl-8.4.0-11.oe2403.x86_64.rpm",
          "libcurl-devel-8.4.0-11.oe2403.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "curl",
        "purl": "pkg:rpm/openEuler/curl\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.4.0-11.oe2403"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\r\n\r\nWhen curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain\u0026apos;s cache entry, making it end sooner or later than otherwise intended.  This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host.  (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.)  When `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain\u0026apos;s expiry timeout *bleed over* and get set for the parent domain `example.com` in curl\u0026apos;s HSTS cache.  The result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different period of time than what was asked for by the origin server. If `example.com` for example stops supporting HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set) timeout expires. This bug can also expire the parent\u0026apos;s entry *earlier*, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended.(CVE-2024-9681)",
  "id": "OESA-2024-2389",
  "modified": "2026-08-06T11:07:52Z",
  "published": "2024-11-15T11:07:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2389"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9681"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "curl security update",
  "upstream": [
    "CVE-2024-9681"
  ]
}

OESA-2024-2472 (CVE-2024-9681)

Vulnerability from osv_openeuler – Published: 2024-11-22 11:07 – Updated: 2026-08-06 11:07 – Source website

Summary

curl security update

Details

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure HTTP:// scheme and perform transfers with hosts like x.example.com as well as example.com where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.) When x.example.com responds with Strict-Transport-Security: headers, this bug can make the subdomain's expiry timeout bleed over and get set for the parent domain example.com in curl's HSTS cache. The result of a triggered bug is that HTTP accesses to example.com get converted to HTTPS for a different period of time than what was asked for by the origin server. If example.com for example stops supporting HTTPS at its expiry time, curl might then fail to access http://example.com until the (wrongly set) timeout expires. This bug can also expire the parent's entry earlier, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended.(CVE-2024-9681)

Severity

5.9 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-9681	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "curl-7.79.1-33.oe2203sp4.aarch64.rpm",
          "curl-debuginfo-7.79.1-33.oe2203sp4.aarch64.rpm",
          "curl-debugsource-7.79.1-33.oe2203sp4.aarch64.rpm",
          "libcurl-7.79.1-33.oe2203sp4.aarch64.rpm",
          "libcurl-devel-7.79.1-33.oe2203sp4.aarch64.rpm"
        ],
        "noarch": [
          "curl-help-7.79.1-33.oe2203sp4.noarch.rpm"
        ],
        "src": [
          "curl-7.79.1-33.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "curl-7.79.1-33.oe2203sp4.x86_64.rpm",
          "curl-debuginfo-7.79.1-33.oe2203sp4.x86_64.rpm",
          "curl-debugsource-7.79.1-33.oe2203sp4.x86_64.rpm",
          "libcurl-7.79.1-33.oe2203sp4.x86_64.rpm",
          "libcurl-devel-7.79.1-33.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "curl",
        "purl": "pkg:rpm/openEuler/curl\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.79.1-33.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\r\n\r\nWhen curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain\u0026apos;s cache entry, making it end sooner or later than otherwise intended.  This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host.  (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.)  When `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain\u0026apos;s expiry timeout *bleed over* and get set for the parent domain `example.com` in curl\u0026apos;s HSTS cache.  The result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different period of time than what was asked for by the origin server. If `example.com` for example stops supporting HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set) timeout expires. This bug can also expire the parent\u0026apos;s entry *earlier*, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended.(CVE-2024-9681)",
  "id": "OESA-2024-2472",
  "modified": "2026-08-06T11:07:57Z",
  "published": "2024-11-22T11:07:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2472"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9681"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "curl security update",
  "upstream": [
    "CVE-2024-9681"
  ]
}

OESA-2024-2473 (CVE-2024-9681)

Vulnerability from osv_openeuler – Published: 2024-11-22 11:07 – Updated: 2026-08-06 11:07 – Source website

Summary

curl security update

Details

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure HTTP:// scheme and perform transfers with hosts like x.example.com as well as example.com where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.) When x.example.com responds with Strict-Transport-Security: headers, this bug can make the subdomain's expiry timeout bleed over and get set for the parent domain example.com in curl's HSTS cache. The result of a triggered bug is that HTTP accesses to example.com get converted to HTTPS for a different period of time than what was asked for by the origin server. If example.com for example stops supporting HTTPS at its expiry time, curl might then fail to access http://example.com until the (wrongly set) timeout expires. This bug can also expire the parent's entry earlier, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended.(CVE-2024-9681)

Severity

5.9 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-9681	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "curl-7.79.1-33.oe2203sp3.aarch64.rpm",
          "curl-debuginfo-7.79.1-33.oe2203sp3.aarch64.rpm",
          "curl-debugsource-7.79.1-33.oe2203sp3.aarch64.rpm",
          "libcurl-7.79.1-33.oe2203sp3.aarch64.rpm",
          "libcurl-devel-7.79.1-33.oe2203sp3.aarch64.rpm"
        ],
        "noarch": [
          "curl-help-7.79.1-33.oe2203sp3.noarch.rpm"
        ],
        "src": [
          "curl-7.79.1-33.oe2203sp3.src.rpm"
        ],
        "x86_64": [
          "curl-7.79.1-33.oe2203sp3.x86_64.rpm",
          "curl-debuginfo-7.79.1-33.oe2203sp3.x86_64.rpm",
          "curl-debugsource-7.79.1-33.oe2203sp3.x86_64.rpm",
          "libcurl-7.79.1-33.oe2203sp3.x86_64.rpm",
          "libcurl-devel-7.79.1-33.oe2203sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP3",
        "name": "curl",
        "purl": "pkg:rpm/openEuler/curl\u0026distro=openEuler-22.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.79.1-33.oe2203sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\r\n\r\nWhen curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain\u0026apos;s cache entry, making it end sooner or later than otherwise intended.  This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host.  (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.)  When `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain\u0026apos;s expiry timeout *bleed over* and get set for the parent domain `example.com` in curl\u0026apos;s HSTS cache.  The result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different period of time than what was asked for by the origin server. If `example.com` for example stops supporting HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set) timeout expires. This bug can also expire the parent\u0026apos;s entry *earlier*, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended.(CVE-2024-9681)",
  "id": "OESA-2024-2473",
  "modified": "2026-08-06T11:07:57Z",
  "published": "2024-11-22T11:07:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2473"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9681"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "curl security update",
  "upstream": [
    "CVE-2024-9681"
  ]
}

OPENSUSE-SU-2024:14476-1

Vulnerability from csaf_opensuse - Published: 2024-11-08 00:00 - Updated: 2026-09-20 21:20

Summary

curl-8.11.0-1.1 on GA media

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2024-9681.

CVE-2024-9681

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Recommended: 32 products

Open the full advisory

SSA-089022

Vulnerability from csaf_siemens - Published: 2026-01-28 00:00 - Updated: 2026-02-24 00:00

Summary

SSA-089022: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.3

Scope

51 vulnerabilities in this advisory, including CVE-2024-9681.

CVE-2024-9681

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

Known affected: 16 products

https://support.industry.siemens.com/cs/ww/en/view/109997626/

Open the full advisory

SSA-355557

Vulnerability from csaf_siemens - Published: 2025-08-12 00:00 - Updated: 2026-02-24 00:00

Summary

SSA-355557: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.2

Scope

486 vulnerabilities in this advisory, including CVE-2024-9681.

CVE-2024-9681

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

Known affected: 3 products

https://support.industry.siemens.com/cs/ww/en/view/109988839/

Open the full advisory

SUSE-SU-2024:3925-1

Vulnerability from csaf_suse - Published: 2024-11-06 10:14 - Updated: 2026-09-20 17:09

Summary

Security update for curl

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2024-9681.

CVE-2024-9681

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Recommended: 66 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-9681 (GCVE-0-2024-9681)

NCSC-2025-0102

NCSC-2025-0103

OESA-2024-2388 (CVE-2024-9681)

OESA-2024-2389 (CVE-2024-9681)

OESA-2024-2472 (CVE-2024-9681)

OESA-2024-2473 (CVE-2024-9681)

OPENSUSE-SU-2024:14476-1

SSA-089022

SSA-355557

SUSE-SU-2024:3925-1

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour