CVE-2024-2379

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

CVSS 3.1

6.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

EPSS

1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-25)

CWE

CWE-295

Published

2024-03-27

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

Affected

• apple:macos
• haxx:curl
• netapp:active_iq_unified_manager
• netapp:bootstrap_os
• netapp:h300s_firmware
• netapp:h410s_firmware
• netapp:h500s_firmware
• netapp:h610c_firmware
• netapp:h610s_firmware
• netapp:h615c_firmware
• netapp:h700s_firmware
• netapp:ontap_select_deploy_administration_utility

References

• http://seclists.org/fulldisclosure/2024/Jul/18
• http://seclists.org/fulldisclosure/2024/Jul/19
• http://seclists.org/fulldisclosure/2024/Jul/20
• http://www.openwall.com/lists/oss-security/2024/03/27/2
• https://curl.se/docs/CVE-2024-2379.html

Check your stackJSON