CVE-2024-9681

When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.) When `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain's expiry timeout *bleed over* and get set for the parent domain `example.com` in curl's HSTS cache. The result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different period of time than what was asked for by the origin server. If `example.com` for example stops supporting HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set) timeout expires. This bug can also expire the parent's entry *earlier*, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended.

• CWE-697

• https://curl.se/docs/CVE-2024-9681.htmlPatch, Vendor Advisory
• https://curl.se/docs/CVE-2024-9681.jsonVendor Advisory
• https://hackerone.com/reports/2764830Exploit, Issue Tracking, Patch, Third Party Advisory
• http://seclists.org/fulldisclosure/2025/Apr/10
• http://seclists.org/fulldisclosure/2025/Apr/11
• http://seclists.org/fulldisclosure/2025/Apr/12
• http://seclists.org/fulldisclosure/2025/Apr/13
• http://seclists.org/fulldisclosure/2025/Apr/4
• http://seclists.org/fulldisclosure/2025/Apr/5
• http://seclists.org/fulldisclosure/2025/Apr/8
• http://seclists.org/fulldisclosure/2025/Apr/9
• http://www.openwall.com/lists/oss-security/2024/11/06/2Mailing List, Patch, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20241213-0006/

Published

Nov 6, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-9675A vulnerability was found in Buildah. Cache mounts do not pr…4.4
• CVE-2024-9676A vulnerability was found in Podman, Buildah, and CRI-O. A s…6.5
• CVE-2024-9677The insufficiently protected credentials vulnerability in th…7.8
• CVE-2024-9678An SQL Injection vulnerability existed in DLP Extension 11.1…4.9
• CVE-2024-9679A Hardcoded Cryptographic key vulnerability existed in DLP E…5.3
• CVE-2024-9680An attacker was able to achieve code execution in the conten…9.8
• CVE-2024-9682The Royal Elementor Addons and Templates plugin for WordPres…5.4
• CVE-2024-9683A vulnerability was found in Quay, which allows successful a…5.3
• CVE-2024-9684FreyrSCADA/IEC-60870-5-104 server v21.06.008 allows remote a…7.5
• CVE-2024-9685The Notification for Telegram plugin for WordPress is vulner…4.3
• CVE-2024-9686The Order Notification for Telegram plugin for WordPress is …5.3
• CVE-2024-9687The WP 2FA with Telegram plugin for WordPress is vulnerable …8.8