CVE-2024-7264

libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.

• CWE-125

• http://www.openwall.com/lists/oss-security/2024/07/31/1Mailing List
• https://curl.se/docs/CVE-2024-7264.htmlVendor Advisory
• https://curl.se/docs/CVE-2024-7264.jsonVendor Advisory
• https://hackerone.com/reports/2629968Exploit, Issue Tracking, Permissions Required, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2024/07/31/1Mailing List
• https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519
• https://security.netapp.com/advisory/ntap-20240828-0008/
• https://security.netapp.com/advisory/ntap-20241025-0006/
• https://security.netapp.com/advisory/ntap-20241025-0010/

Published

Jul 31, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-7258The WooCommerce Google Feed Manager plugin for WordPress is …8.8
• CVE-2024-7259A flaw was found in oVirt. A user with administrator privile…4.9
• CVE-2024-7260An open redirect vulnerability was found in Keycloak. A spec…6.1
• CVE-2024-7261The improper neutralization of special elements in the param…9.8
• CVE-2024-7262Improper path validation in promecefpluginhost.exe in Kingso…7.8
• CVE-2024-7263Improper path validation in promecefpluginhost.exe in Kingso…7.8
• CVE-2024-7265Incorrect User Management vulnerability in Naukowa i Akademi…8.8
• CVE-2024-7266Incorrect User Management vulnerability in Naukowa i Akademi…4.3
• CVE-2024-7267Exposure of Sensitive Information vulnerability in Naukowa i…6.5
• CVE-2024-7269Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2024-7272A vulnerability, which was classified as critical, was found…8.8
• CVE-2024-7273A vulnerability classified as critical was found in itsource…9.8