{"metadata": {"vulnerability": "CVE-2024-6874", "count": 103, "kinds": {"milestone": 26, "sighting": 3, "kev": 0, "other": 74}}, "data": [{"timestamp": "2024-07-01T07:00:00Z", "date_only": false, "value": "2024-07-01T07:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-6874", "record": "MSRC_CVE-2024-6874", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2024-07-18T03:37:32.294Z", "date_only": false, "value": "2024-07-18T03:37:32.294Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2024-6874", "field": "cveMetadata.dateReserved"}, {"timestamp": "2024-07-23T22:00:00Z", "date_only": false, "value": "2024-07-23T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1697", "record": "WID-SEC-W-2024-1697", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2024-07-23T22:00:00Z", "date_only": false, "value": "2024-07-23T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1697", "record": "WID-SEC-W-2024-1697", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2024-07-23T22:00:00Z", "date_only": false, "value": "2024-07-23T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1697", "record": "WID-SEC-W-2024-1697", "field": "vulnerabilities.1.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2024-07-24T07:36:26.887Z", "date_only": false, "value": "2024-07-24T07:36:26.887Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2024-6874", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2024-07-24T07:40:07.072Z", "date_only": false, "value": "2024-07-24T07:40:07.072Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / curl", "record": "CVE-2024-6874", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2024-07-24T08:15:03Z", "date_only": false, "value": "2024-07-24T08:15:03Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-CHHH-4XRF-42PG", "record": "GHSA-CHHH-4XRF-42PG", "field": "database_specific.nvd_published_at"}, {"timestamp": "2024-07-24T08:15:03.413Z", "date_only": false, "value": "2024-07-24T08:15:03.413", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-6874", "record": "FKIE_CVE-2024-6874", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2024-07-24T09:30:40Z", "date_only": false, "value": "2024-07-24T09:30:40Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-CHHH-4XRF-42PG", "record": "GHSA-CHHH-4XRF-42PG", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2024-07-24T10:47:44Z", "date_only": false, "value": "2024-07-24T10:47:44.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/1548", "record": "CVE-2024-6874", "field": "creation_timestamp", "uuid": "0dbf92d6-f1f8-469d-a65a-6d5f4a7881fe", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6874 - Libcurl Punycode Buffer Overflow\", \n  \"Content\": \"CVE ID : CVE-2024-6874 \nPublished : July 24, 2024, 8:15 a.m. | 27\u00a0minutes ago \nDescription : libcurl's URL API function  \n[curl_url_get()]() offers punycode  \nconversions, to and from IDN. Asking to convert a name that is exactly 256  \nbytes, libcurl ends up reading outside of a stack based buffer when built to  \nuse the *macidn* IDN backend. The conversion function then fills up the  \nprovided buffer exactly - but does not null terminate the string.  \n  \nThis flaw can lead to stack contents accidently getting returned as part of  \nthe converted string. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"24 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/1548"}, {"timestamp": "2024-07-24T16:13:40.560Z", "date_only": false, "value": "2024-07-24T16:13:40.560966Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2024-6874", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2024-07-24T16:13:40.560Z", "date_only": false, "value": "2024-07-24T16:13:40.560966Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-6874", "record": "FKIE_CVE-2024-6874", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2024-07-24T16:25:51.575Z", "date_only": false, "value": "2024-07-24T16:25:51.575Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2024-6874", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-07-25T22:00:00Z", "date_only": false, "value": "2024-07-25T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1697", "record": "WID-SEC-W-2024-1697", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2024-07-26T05:57:38.298Z", "date_only": false, "value": "2024-07-26T05:57:38.298590Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2024-6874", "record": "BELL-CVE-2024-6874", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2024-07-30T00:00:00Z", "date_only": false, "value": "2024-07-30T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:14225-1", "record": "OPENSUSE-SU-2024:14225-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2024-07-30T00:00:00Z", "date_only": false, "value": "2024-07-30T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:14225-1", "record": "OPENSUSE-SU-2024:14225-1", "field": "document.tracking.generator.date"}, {"timestamp": "2024-07-30T00:00:00Z", "date_only": false, "value": "2024-07-30T00:00:00Z", "kind": "other", "label": "Impact", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:14225-1", "record": "OPENSUSE-SU-2024:14225-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2024-07-30T00:00:00Z", "date_only": false, "value": "2024-07-30T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:14225-1", "record": "OPENSUSE-SU-2024:14225-1", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2024-08-01T15:32:07Z", "date_only": false, "value": "2024-08-01T15:32:07Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-CHHH-4XRF-42PG", "record": "GHSA-CHHH-4XRF-42PG", "field": "modified"}, {"timestamp": "2024-08-06T22:00:00Z", "date_only": false, "value": "2024-08-06T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1697", "record": "WID-SEC-W-2024-1697", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2024-08-13T00:00:00Z", "date_only": true, "value": "2024-08-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0676", "record": "CERTFR-2024-AVI-0676", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2024-08-14T00:00:00Z", "date_only": false, "value": "2024-08-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0676", "record": "CERTFR-2024-AVI-0676", "field": "revisions.0.revision_date"}, {"timestamp": "2024-08-22T18:03:17.766Z", "date_only": false, "value": "2024-08-22T18:03:17.766Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2024-6874", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2024-09-05T00:00:00Z", "date_only": true, "value": "2024-09-05", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0780", "record": "CERTFR-2024-AVI-0780", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2024-09-11T00:00:00Z", "date_only": true, "value": "2024-09-11", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0780", "record": "CERTFR-2024-AVI-0780", "field": "vendor_advisories.1.published_at"}, {"timestamp": "2024-09-13T00:00:00Z", "date_only": false, "value": "2024-09-13T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0780", "record": "CERTFR-2024-AVI-0780", "field": "revisions.0.revision_date"}, {"timestamp": "2024-09-24T22:00:00Z", "date_only": false, "value": "2024-09-24T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1697", "record": "WID-SEC-W-2024-1697", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2024-10-01T00:00:00Z", "date_only": false, "value": "2024-10-01T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-6874", "record": "MSRC_CVE-2024-6874", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2024-10-01T00:00:00Z", "date_only": false, "value": "2024-10-01T00:00:00.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-6874", "record": "MSRC_CVE-2024-6874", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2024-10-08T22:00:00Z", "date_only": false, "value": "2024-10-08T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1697", "record": "WID-SEC-W-2024-1697", "field": "document.tracking.revision_history.4.date"}, {"timestamp": "2025-01-12T23:00:00Z", "date_only": false, "value": "2025-01-12T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1697", "record": "WID-SEC-W-2024-1697", "field": "document.tracking.revision_history.5.date"}, {"timestamp": "2025-02-13T17:58:00.151Z", "date_only": false, "value": "2025-02-13T17:58:00.151Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2024-6874", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-03-13T00:00:00Z", "date_only": false, "value": "2025-03-13T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-6874", "record": "MSRC_CVE-2024-6874", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2025-04-17T00:00:00Z", "date_only": true, "value": "2025-04-17", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0328", "record": "CERTFR-2025-AVI-0328", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2025-04-17T00:00:00Z", "date_only": false, "value": "2025-04-17T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0328", "record": "CERTFR-2025-AVI-0328", "field": "revisions.0.revision_date"}, {"timestamp": "2025-06-04T22:00:00Z", "date_only": false, "value": "2025-06-04T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1697", "record": "WID-SEC-W-2024-1697", "field": "document.tracking.revision_history.6.date"}, {"timestamp": "2025-08-12T00:00:00Z", "date_only": false, "value": "2025-08-12T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-226-07", "record": "ICSA-25-226-07", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-08-12T00:00:00Z", "date_only": false, "value": "2025-08-12T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-355557", "record": "SSA-355557", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-08-12T00:00:00Z", "date_only": false, "value": "2025-08-12T00:00:00.000000Z", "kind": "milestone", "label": "Published", "source": "csaf_cisa \u00b7 ICSA-25-226-07", "record": "ICSA-25-226-07", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-08-12T00:00:00Z", "date_only": false, "value": "2025-08-12T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_siemens \u00b7 SSA-355557", "record": "SSA-355557", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-09-12T12:15:10Z", "date_only": false, "value": "2025-09-12T12:15:10Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2025:03198-1", "record": "SUSE-SU-2025:03198-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-09-12T12:15:10Z", "date_only": false, "value": "2025-09-12T12:15:10Z", "kind": "other", "label": "Document generated", "source": "csaf_suse \u00b7 SUSE-SU-2025:03198-1", "record": "SUSE-SU-2025:03198-1", "field": "document.tracking.generator.date"}, {"timestamp": "2025-09-12T12:15:10Z", "date_only": false, "value": "2025-09-12T12:15:10Z", "kind": "other", "label": "Impact", "source": "csaf_suse \u00b7 SUSE-SU-2025:03198-1", "record": "SUSE-SU-2025:03198-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2025-09-12T12:15:10Z", "date_only": false, "value": "2025-09-12T12:15:10Z", "kind": "milestone", "label": "Published", "source": "csaf_suse \u00b7 SUSE-SU-2025:03198-1", "record": "SUSE-SU-2025:03198-1", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-09-12T12:15:10Z", "date_only": false, "value": "2025-09-12T12:15:10Z", "kind": "other", "label": "Updated", "source": "csaf_suse \u00b7 SUSE-SU-2025:03198-1", "record": "SUSE-SU-2025:03198-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-09-14T22:00:00Z", "date_only": false, "value": "2025-09-14T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1697", "record": "WID-SEC-W-2024-1697", "field": "document.tracking.revision_history.7.date"}, {"timestamp": "2025-11-04T23:00:00Z", "date_only": false, "value": "2025-11-04T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1697", "record": "WID-SEC-W-2024-1697", "field": "document.tracking.revision_history.8.date"}, {"timestamp": "2025-11-04T23:00:00Z", "date_only": false, "value": "2025-11-04T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1697", "record": "WID-SEC-W-2024-1697", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-11-05T09:14:20.024Z", "date_only": false, "value": "2025-11-05T09:14:20.024+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1697", "record": "WID-SEC-W-2024-1697", "field": "document.tracking.generator.date"}, {"timestamp": "2025-12-15T06:06:18.594Z", "date_only": false, "value": "2025-12-15T06:06:18.594272Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2024-6874", "record": "BELL-CVE-2024-6874", "field": "modified"}, {"timestamp": "2026-01-28T00:00:00Z", "date_only": false, "value": "2026-01-28T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-26-043-06", "record": "ICSA-26-043-06", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-01-28T00:00:00Z", "date_only": false, "value": "2026-01-28T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-089022", "record": "SSA-089022", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-01-28T00:00:00Z", "date_only": true, "value": "2026-01-28", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0101", "record": "CERTFR-2026-AVI-0101", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-01-28T00:00:00Z", "date_only": false, "value": "2026-01-28T00:00:00.000000Z", "kind": "milestone", "label": "Published", "source": "csaf_cisa \u00b7 ICSA-26-043-06", "record": "ICSA-26-043-06", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-01-28T00:00:00Z", "date_only": false, "value": "2026-01-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_siemens \u00b7 SSA-089022", "record": "SSA-089022", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-01-29T00:00:00Z", "date_only": false, "value": "2026-01-29T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0101", "record": "CERTFR-2026-AVI-0101", "field": "last_revision_date"}, {"timestamp": "2026-01-29T00:00:00Z", "date_only": false, "value": "2026-01-29T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0101", "record": "CERTFR-2026-AVI-0101", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-01-29T00:00:00Z", "date_only": false, "value": "2026-01-29T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0101", "record": "CERTFR-2026-AVI-0101", "field": "revisions.0.revision_date"}, {"timestamp": "2026-02-12T00:00:00Z", "date_only": false, "value": "2026-02-12T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-226-07", "record": "ICSA-25-226-07", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-02-12T00:00:00Z", "date_only": false, "value": "2026-02-12T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-355557", "record": "SSA-355557", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-02-12T07:00:00Z", "date_only": false, "value": "2026-02-12T07:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-26-043-06", "record": "ICSA-26-043-06", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-02-12T11:00:00Z", "date_only": false, "value": "2026-02-12T11:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-06", "record": "CVE-2024-6874", "field": "creation_timestamp", "uuid": "375a165e-f0c4-4d27-82b3-2b62cf2b763a", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-06"}, {"timestamp": "2026-02-18T02:46:17Z", "date_only": false, "value": "2026-02-18T02:46:17.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-6874", "record": "MSRC_CVE-2024-6874", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-02-18T02:46:17Z", "date_only": false, "value": "2026-02-18T02:46:17.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-6874", "record": "MSRC_CVE-2024-6874", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-02-18T10:54:58.541Z", "date_only": false, "value": "2026-02-18T10:54:58.541Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-6874", "record": "MSRC_CVE-2024-6874", "field": "document.tracking.generator.date"}, {"timestamp": "2026-02-24T00:00:00Z", "date_only": false, "value": "2026-02-24T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-226-07", "record": "ICSA-25-226-07", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-02-24T00:00:00Z", "date_only": false, "value": "2026-02-24T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-26-043-06", "record": "ICSA-26-043-06", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-02-24T00:00:00Z", "date_only": false, "value": "2026-02-24T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-089022", "record": "SSA-089022", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-02-24T00:00:00Z", "date_only": false, "value": "2026-02-24T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-355557", "record": "SSA-355557", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-02-24T00:00:00Z", "date_only": false, "value": "2026-02-24T00:00:00Z", "kind": "other", "label": "Updated", "source": "csaf_siemens \u00b7 SSA-089022", "record": "SSA-089022", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-02-24T00:00:00Z", "date_only": false, "value": "2026-02-24T00:00:00Z", "kind": "other", "label": "Updated", "source": "csaf_siemens \u00b7 SSA-355557", "record": "SSA-355557", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-02-25T07:00:00Z", "date_only": false, "value": "2026-02-25T07:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-226-07", "record": "ICSA-25-226-07", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2026-02-25T07:00:00Z", "date_only": false, "value": "2026-02-25T07:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-26-043-06", "record": "ICSA-26-043-06", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2026-02-25T07:00:00Z", "date_only": false, "value": "2026-02-25T07:00:00.000000Z", "kind": "other", "label": "Updated", "source": "csaf_cisa \u00b7 ICSA-25-226-07", "record": "ICSA-25-226-07", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-02-25T07:00:00Z", "date_only": false, "value": "2026-02-25T07:00:00.000000Z", "kind": "other", "label": "Updated", "source": "csaf_cisa \u00b7 ICSA-26-043-06", "record": "ICSA-26-043-06", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-02-25T17:30:48.835Z", "date_only": false, "value": "2026-02-25T17:30:48.835210Z", "kind": "other", "label": "Document generated", "source": "csaf_cisa \u00b7 ICSA-26-043-06", "record": "ICSA-26-043-06", "field": "document.tracking.generator.date"}, {"timestamp": "2026-02-25T17:30:49.147Z", "date_only": false, "value": "2026-02-25T17:30:49.147507Z", "kind": "other", "label": "Document generated", "source": "csaf_cisa \u00b7 ICSA-25-226-07", "record": "ICSA-25-226-07", "field": "document.tracking.generator.date"}, {"timestamp": "2026-04-01T09:55:24.898Z", "date_only": false, "value": "2026-04-01T09:55:24.898216Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-LQ42192", "record": "CLEANSTART-2026-LQ42192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-04-01T09:55:26.061Z", "date_only": false, "value": "2026-04-01T09:55:26.061155Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-BW46578", "record": "CLEANSTART-2026-BW46578", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-04-01T09:55:26.067Z", "date_only": false, "value": "2026-04-01T09:55:26.067667Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-AY18527", "record": "CLEANSTART-2026-AY18527", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-04-01T09:57:04.724Z", "date_only": false, "value": "2026-04-01T09:57:04.724781Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-OF85770", "record": "CLEANSTART-2026-OF85770", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-11T12:23:09Z", "date_only": false, "value": "2026-05-11T12:23:09.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/Caixa-git/b651dc90f3055319340ba3e6976fb35e", "record": "CVE-2024-6874", "field": "creation_timestamp", "uuid": "0848c967-6f45-4527-83e5-facf55f77b2c", "content": "# Vulnerability Report: curl/libcurl PUSH_PROMISE Heap Buffer Over-read\n\n## Summary\n\nA heap buffer over-read vulnerability exists in curl's HTTP/2 implementation (`lib/http2.c` line 1489). When processing PUSH_PROMISE frames, the `on_header` callback uses `curl_maprintf(\"%s:%s\", ...)` to store header name:value pairs, but the `name` and `value` pointers provided by the nghttp2 library are **not guaranteed to be null-terminated**. The `%s` format specifier reads past the intended buffer boundary until a null byte is found, causing an out-of-bounds heap read.\n\n## Vulnerability Details\n\n### Bug Location\n\n**File:** `lib/http2.c` \u2014 line 1489  \n**Function:** `on_header()` (callback invoked by nghttp2 for each HTTP/2 header)  \n**Trigger:** PUSH_PROMISE frame processing\n\n### Vulnerable Code\n\n```c\n// line 1489 \u2014 BUG: name/value are NOT null-terminated\nh = curl_maprintf(\"%s:%s\", name, value);\n```\n\n### Root Cause\n\nThe `on_header` callback receives `name` and `value` as `const uint8_t *` pointers into nghttp2's internal HPACK decoding buffer. The nghttp2 API documentation explicitly documents length-limited parameters:\n\n```\ntypedef int (*nghttp2_on_header_callback)(\n    nghttp2_session *session,\n    const nghttp2_frame *frame,\n    const uint8_t *name,   // NOT null-terminated\n    size_t namelen,         // length provided separately\n    const uint8_t *value,  // NOT null-terminated\n    size_t valuelen,        // length provided separately\n    uint8_t flags,\n    void *userp\n);\n```\n\nUsing `%s` with a non-null-terminated buffer causes:\n1. **Heap memory leak** \u2014 contiguous heap data following the intended value is read into the header string\n2. **Potential crash** \u2014 reading across a memory page boundary into unmapped memory causes SIGSEGV\n3. **Information disclosure** \u2014 the over-read data is stored in `push_headers[]` and passed to the application's `CURLOPT_PUSHFUNCTION` callback\n\n### Correct Pattern (exists in same file)\n\nThe same function correctly handles non-null-terminated data in the trailer processing path (line 1500):\n\n```c\n// line 1500 \u2014 CORRECT: uses %.*s with explicit length\nCURL_TRC_CF(data_s, cf, \"[%d] trailer: %.*s: %.*s\",\n            stream->id, (int)namelen, name, (int)valuelen, value);\n```\n\nAnd in the non-PUSH header path (line 1502):\n\n```c\n// line 1502 \u2014 CORRECT: uses explicit length\nresult = Curl_dynhds_add(&stream->resp_trailers,\n                         (const char *)name, namelen,\n                         (const char *)value, valuelen);\n```\n\n### Fix\n\nReplace line 1489 with:\n\n```c\nh = curl_maprintf(\"%.*s:%.*s\", (int)namelen, name, (int)valuelen, value);\n```\n\n## Impact\n\n| Impact | Description |\n|--------|-------------|\n| **Information Disclosure** | Heap contents adjacent to the header value buffer are read and returned to the application through `curl_pushheader_bynum()` / `curl_pushheader_byname()` in the PUSH callback. This can leak sensitive heap data (session keys, TLS buffers, other connection data) to the application. |\n| **Denial of Service** | If the over-read crosses a page boundary into unmapped memory, the process crashes with SIGSEGV. |\n| **Data Corruption** | A malformed string may cause incorrect parsing of pushed headers by the application. |\n\n**Attack Vector:** A malicious or compromised HTTP/2 server sends a crafted PUSH_PROMISE frame. The attacker needs to be in control of the HTTP/2 server or have MITM capability (TLS interception).\n\n**CWE Classification:** CWE-125: Out-of-bounds Read  \n**C Mistake Category:** OVERREAD\n\n## Affected Versions\n\n- **Affected:** All versions of curl built with HTTP/2 support (nghttp2) that include PUSH_PROMISE handling\n- **First vulnerable:** commit introducing PUSH_PROMISE support in `on_header` callback\n- **Last vulnerable:** latest released version (the bug remains unpatched at time of report)\n\nThe vulnerability requires `CURLOPT_PUSHFUNCTION` to be set by the application for the heap data to be leaked to the caller. However, the buffer over-read itself occurs regardless \u2014 the heap data is read into `push_headers[]` memory regardless of whether the application registers a push callback.\n\n## Steps to Reproduce\n\n### Method 1: Code Analysis (Static)\n\nExamine `lib/http2.c` lines 1489 and 1500-1504 side by side:\n\n```\nLine 1489:   h = curl_maprintf(\"%s:%s\", name, value);                    \u2190 BUG\nLine 1500:   ... \"%.*s: %.*s\", (int)namelen, name, (int)valuelen, value  \u2190 CORRECT\nLine 1502-3: Curl_dynhds_add(..., name, namelen, value, valuelen);      \u2190 CORRECT\n```\n\nThe same function uses three different patterns for the same data. Only the PUSH_PROMISE path uses the unsafe `%s`.\n\n### Method 2: AddressSanitizer (Dynamic)\n\n1. Build curl with AddressSanitizer:\n   ```bash\n   mkdir build-asan && cd build-asan\n   cmake .. -DCMAKE_BUILD_TYPE=Debug \\\n            -DCMAKE_C_FLAGS=\"-fsanitize=address -fno-omit-frame-pointer\" \\\n            -DCMAKE_EXE_LINKER_FLAGS=\"-fsanitize=address\"\n   make -j$(nproc)\n   ```\n\n2. Run the PoC malicious HTTP/2 server (Python, see attached):\n   ```bash\n   python3 poc_server.py\n   ```\n\n3. Connect with curl setting a PUSH callback:\n   ```bash\n   curl --http2-prior-knowledge -k https://localhost:8443/push-test\n   ```\n\n4. ASAN will report a heap-buffer-overflow on the `curl_maprintf` call.\n\n### Method 3: Manual Trigger\n\nWrite a minimal C program using `curl_multi` with `CURLMOPT_PUSHFUNCTION`:\n```c\nstatic int push_cb(CURL *parent, CURL *child,\n                   size_t num_headers,\n                   struct curl_pushheaders *headers,\n                   void *userp) {\n    for (size_t i = 0; i < num_headers; i++) {\n        char *h = curl_pushheader_bynum(headers, i);\n        // h may contain heap data beyond the intended header value\n        printf(\"[%zu] %s\\n\", i, h);\n    }\n    return CURL_PUSH_DENY;\n}\n```\n\n## Supporting Material\n\nAttached:\n1. `poc_server.py` \u2014 Malicious HTTP/2 server that sends crafted PUSH_PROMISE\n2. `test_poc.py` \u2014 Automated test harness with ASAN build\n3. Code diff showing the bug and its fix\n\n## Timeline\n\n- **Discovery:** 2026-05-08\n- **Reported:** [Date of HackerOne submission]\n- **curl advisory:** Pending\n\n## Reporter\n\n- **Name:** [Your Name]\n- **HackerOne:** [Your HackerOne handle]\n\n---\n\n## Appendix A: Fix Commit Preview\n\n```diff\n--- a/lib/http2.c\n+++ b/lib/http2.c\n@@ -1486,7 +1486,7 @@ static int on_header(nghttp2_session *session, const nghttp2_frame *frame,\n       stream->push_headers = headp;\n     }\n-    h = curl_maprintf(\"%s:%s\", name, value);\n+    h = curl_maprintf(\"%.*s:%.*s\", (int)namelen, name, (int)valuelen, value);\n     if(!h) {\n       free_push_headers(stream);\n       return NGHTTP2_ERR_CALLBACK_FAILURE;\n```\n\n## Appendix B: CWE Reference\n\nCWE-125: Out-of-bounds Read  \nThe product reads data past the end, or before the beginning, of the intended buffer.\n\n## Appendix C: Related CVEs (same pattern in curl)\n\n| CVE | Description | Severity | Bounty |\n|-----|-------------|----------|--------|\n| CVE-2025-9086 | Out of bounds read for cookie path | Low | $505 |\n| CVE-2024-7264 | ASN.1 date parser overread | Low | $540 |\n| CVE-2024-6874 | macidn punycode buffer overread | Low | $540 |\n", "url": "https://gist.github.com/Caixa-git/b651dc90f3055319340ba3e6976fb35e"}, {"timestamp": "2026-05-18T13:43:50.870Z", "date_only": false, "value": "2026-05-18T13:43:50.870849Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-DI23929", "record": "CLEANSTART-2026-DI23929", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-06-17T08:18:53.063Z", "date_only": false, "value": "2026-06-17T08:18:53.063", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-6874", "record": "FKIE_CVE-2024-6874", "field": "lastModified"}, {"timestamp": "2026-07-30T07:10:53Z", "date_only": false, "value": "2026-07-30T07:10:53Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-HX55432", "record": "CLEANSTART-2026-HX55432", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-09T10:55:12Z", "date_only": false, "value": "2026-09-09T10:55:12Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-AY18527", "record": "CLEANSTART-2026-AY18527", "field": "modified"}, {"timestamp": "2026-09-09T10:55:12Z", "date_only": false, "value": "2026-09-09T10:55:12Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-BW46578", "record": "CLEANSTART-2026-BW46578", "field": "modified"}, {"timestamp": "2026-09-09T10:55:12Z", "date_only": false, "value": "2026-09-09T10:55:12Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-AY18527", "record": "CLEANSTART-2026-AY18527", "field": "withdrawn"}, {"timestamp": "2026-09-09T10:55:12Z", "date_only": false, "value": "2026-09-09T10:55:12Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-BW46578", "record": "CLEANSTART-2026-BW46578", "field": "withdrawn"}, {"timestamp": "2026-09-18T10:27:47.484Z", "date_only": false, "value": "2026-09-18T10:27:47.484721Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-AW71894", "record": "CLEANSTART-2026-AW71894", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-DI23929", "record": "CLEANSTART-2026-DI23929", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-HX55432", "record": "CLEANSTART-2026-HX55432", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-LQ42192", "record": "CLEANSTART-2026-LQ42192", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-OF85770", "record": "CLEANSTART-2026-OF85770", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-DI23929", "record": "CLEANSTART-2026-DI23929", "field": "withdrawn"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-HX55432", "record": "CLEANSTART-2026-HX55432", "field": "withdrawn"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-LQ42192", "record": "CLEANSTART-2026-LQ42192", "field": "withdrawn"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-OF85770", "record": "CLEANSTART-2026-OF85770", "field": "withdrawn"}, {"timestamp": "2026-09-20T21:16:00Z", "date_only": false, "value": "2026-09-20T21:16:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:14225-1", "record": "OPENSUSE-SU-2024:14225-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-20T21:16:00Z", "date_only": false, "value": "2026-09-20T21:16:00Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:14225-1", "record": "OPENSUSE-SU-2024:14225-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-08T18:05:19Z", "date_only": false, "value": "2026-10-08T18:05:19Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-AW71894", "record": "CLEANSTART-2026-AW71894", "field": "modified"}], "metrics": {"as_of": "2026-11-02T16:24:41.053Z", "anchors": {"origin": {"timestamp": "2024-07-01T07:00:00Z", "date_only": false, "value": "2024-07-01T07:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-6874", "record": "MSRC_CVE-2024-6874", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2024-07-01T07:00:00Z", "date_only": false, "value": "2024-07-01T07:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-6874", "record": "MSRC_CVE-2024-6874", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": {"timestamp": "2024-10-01T00:00:00Z", "date_only": false, "value": "2024-10-01T00:00:00.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-6874", "record": "MSRC_CVE-2024-6874", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start"]}, "total_time_to_patch": {"available": false, "missing": ["start"]}, "disclosure_to_patch": {"available": true, "seconds": 7923600.0, "hours": 2201.0, "days": 91.70833333333333, "min_seconds": 7923600.0, "max_seconds": 8010000.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2024-07-01T07:00:00Z", "date_only": false, "value": "2024-07-01T07:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-6874", "record": "MSRC_CVE-2024-6874", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2024-10-01T00:00:00Z", "date_only": false, "value": "2024-10-01T00:00:00.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-6874", "record": "MSRC_CVE-2024-6874", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "time_unpatched": {"available": true, "seconds": 7923600.0, "hours": 2201.0, "days": 91.70833333333333, "min_seconds": 7923600.0, "max_seconds": 8010000.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2024-07-01T07:00:00Z", "date_only": false, "value": "2024-07-01T07:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-6874", "record": "MSRC_CVE-2024-6874", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2024-10-01T00:00:00Z", "date_only": false, "value": "2024-10-01T00:00:00.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-6874", "record": "MSRC_CVE-2024-6874", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}