{"answers":{"affected":"It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6874 exists.","fix":"Upgrade to a fixed version.","what":"CVE-2024-6874 is a low-severity vulnerability in Haxx Libcurl, published on 24 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-6874 and fix it if it is affected.\n\nWhat it is: CVE-2024-6874 is a low-severity vulnerability in Haxx Libcurl, published on 24 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6874 exists.\n\nAffected product: Haxx Libcurl. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-6874/ (Markdown: https://insights.sbomify.com/CVE-2024-6874/index.md)","id":"CVE-2024-6874","markdown":"https://insights.sbomify.com/CVE-2024-6874/index.md","name":"CVE-2024-6874","record":{"aliases":["ALPINE-CVE-2024-6874","AZL-47020","AZL-47046","AZL-49664","BELL-CVE-2024-6874","CLEANSTART-2026-AW71894","CURL-CVE-2024-6874","DEBIAN-CVE-2024-6874","GHSA-chhh-4xrf-42pg","JLSEC-2025-37"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":true,"product_category":"libcurl library","requires_auth":"low_privilege","summary":"An attacker can trigger a buffer overread in libcurl's macidn backend, potentially leaking stack contents when processing specific IDN names.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"curl","cpe":[{"product":"libcurl","vendor":"haxx"}],"cvss":{"score":3.1,"severity":"low","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-125","name":"Out-of-bounds Read"}],"description":"libcurl's URL API function\n[curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode\nconversions, to and from IDN. Asking to convert a name that is exactly 256\nbytes, libcurl ends up reading outside of a stack based buffer when built to\nuse the *macidn* IDN backend. The conversion function then fills up the\nprovided buffer exactly - but does not null terminate the string.\n\nThis flaw can lead to stack contents accidently getting returned as part of\nthe converted string.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"macidn punycode buffer overread","id":"CVE-2024-6874","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"haxx:libcurl","products":["haxx:libcurl"],"type":"information_disclosure","year":"2024"},"n_packages":0,"n_references":4,"next":{"headline":"Infinispan: infinispan: rest compare api has buffer leak","id":"CVE-2024-6875"},"packages":[],"prev":{"headline":"Specially crafted request could caused undefined behaviour which may lead to Remote Code Execution.","id":"CVE-2024-6873"},"products":["curl"],"published":"2024-07-24","related":[{"cvss_score":7.5,"headline":"freeing stack buffer in utf8asn1str","id":"CVE-2024-6197","kev_date_added":null,"published":"2024-07-24"},{"cvss_score":7.5,"headline":"Memory corruption in n/a","id":"CVE-2017-1000254","kev_date_added":null,"published":"2017-10-06"},{"cvss_score":7.5,"headline":"Auth bypass in n/a","id":"CVE-2016-7141","kev_date_added":null,"published":"2016-10-03"},{"cvss_score":6.5,"headline":"Information disclosure in n/a","id":"CVE-2017-1000099","kev_date_added":null,"published":"2017-10-04"},{"cvss_score":6.5,"headline":"Information disclosure in n/a","id":"CVE-2017-1000100","kev_date_added":null,"published":"2017-10-04"},{"cvss_score":6.3,"headline":"ASN.1 date parser overread","id":"CVE-2024-7264","kev_date_added":null,"published":"2024-07-31"},{"cvss_score":4.8,"headline":"Security feature bypass in curl","id":"CVE-2017-7468","kev_date_added":null,"published":"2018-07-16"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-02-13","vendors":["curl"]},"summary":"An attacker can trigger a buffer overread in libcurl's macidn backend, potentially leaking stack contents when processing specific IDN names.","url":"https://insights.sbomify.com/CVE-2024-6874/"}