CVE-2024-6874

Name of the Vulnerable Software and Affected Versions cURL (affected versions not specified)

Description The issue is related to the curl url get() function in the cURL utility, which is used for Punycode conversions of IDN domains. When a name exactly 256 bytes is converted, it can cause the function to read outside a stack-based buffer, leading to potential information disclosure. This flaw can result in stack contents being returned as part of the converted string. The vulnerability may allow a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.