CVE-2024-6874

libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the *macidn* IDN backend. The conversion function then fills up the provided buffer exactly - but does not null terminate the string. This flaw can lead to stack contents accidently getting returned as part of the converted string.

• CWE-125

• http://www.openwall.com/lists/oss-security/2024/07/24/2Mailing List, Third Party Advisory
• https://curl.se/docs/CVE-2024-6874.htmlVendor Advisory
• https://curl.se/docs/CVE-2024-6874.jsonVendor Advisory
• https://hackerone.com/reports/2604391Exploit, Issue Tracking, Technical Description
• http://www.openwall.com/lists/oss-security/2024/07/24/2Mailing List, Third Party Advisory
• https://curl.se/docs/CVE-2024-6874.htmlVendor Advisory
• https://curl.se/docs/CVE-2024-6874.jsonVendor Advisory
• https://hackerone.com/reports/2604391Exploit, Issue Tracking, Technical Description
• https://security.netapp.com/advisory/ntap-20240822-0004/

Published

Jul 24, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-6868mudler/LocalAI version 2.17.1 allows for arbitrary file writ…9.8
• CVE-2024-6869The Falang multilanguage for WordPress plugin for WordPress …7.1
• CVE-2024-6870The Responsive Lightbox & Gallery plugin for WordPress is vu…5.4
• CVE-2024-6871G DATA Total Security Incorrect Permission Assignment Local …7.8
• CVE-2024-6872The Build Your Dream Website Fast with 400+ Starter Template…5.4
• CVE-2024-6873It is possible to crash or redirect the execution flow of th…8.1
• CVE-2024-6875A vulnerability was found in the Infinispan component in Red…6.5
• CVE-2024-6876Out-of-Bounds read vulnerability in OSCAT Basic Library allo…4.4
• CVE-2024-6877Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2024-6878Files or Directories Accessible to External Parties vulnerab…9.2
• CVE-2024-6879The Quiz and Survey Master (QSM) WordPress plugin before 9.…4.7
• CVE-2024-6880During MegaBIP installation process, a user is encouraged to…6.9