Usage of disabled protocol (curl curl)

CVE-2024-2004

LOW 3.5

At a glance

Source: NVD
EPSS: EPSS 1.68 % · percentile 77 (2026-10-31)
State: PUBLISHED
Published: 2024-03-27 07:54 UTC
Updated: 2026-10-15 00:21 UTC
Assigner: curl
NVD status: Modified

Search on…

Description

When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.

Weaknesses (CWE)

CWE-436 — Interpretation Conflict

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	LOW 3.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N	CISA-ADP
CVSS 3.1	LOW 3.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

European references

ENISA EUVD · EUVD-2024-26974
GCVE · GCVE-0-2024-2004

CERT-FR advisories

CERTFR-2025-AVI-0969 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2025-AVI-0756 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2025-AVI-0309 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2024-AVI-0676 — Multiples vulnérabilités dans Tenable Security Center · cert.ssi.gouv.fr
CERTFR-2024-AVI-0634 — Multiples vulnérabilités dans les produits Apple · cert.ssi.gouv.fr
CERTFR-2024-AVI-0579 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2024-AVI-0538 — Multiples vulnérabilités dans Tenable Identity Exposure · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* ≥ 7.85.0 < 8.7.0
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* < 12.7.6
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* ≥ 13.0 < 13.6.8
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* ≥ 14.0 < 14.6
cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Affected products

Product	Versions
curl · curl	affected 8.6.0 ≤ 8.6.0 ; affected 8.5.0 ≤ 8.5.0 ; affected 8.4.0 ≤ 8.4.0 ; affected 8.3.0 ≤ 8.3.0 ; affected 8.2.1 ≤ 8.2.1 ; affected 8.2.0 ≤ 8.2.0

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟢 Usage of disabled protocol (curl curl)