CVE-2024-6874

A buffer overread vulnerability was found in Curl's URL API function curl_url_get(). This issue allows a remote attacker to obtain sensitive information due to a punycode buffer overread flaw. By sending a specially crafted request, an attacker can gain sensitive information and potentially launch further attacks against the affected system.

This bug was introduced in the Curl 8.8.0 release. However, Red Hat has not yet included Curl 8.8.0 in any of its products.

Additionally, since this vulnerability only affects MacOS builds, Red Hat remains unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.