{"schema_version":"1.7.5","id":"CURL-CVE-2024-6874","published":"2024-07-24T08:00:00Z","modified":"2026-05-27T02:29:29.570487Z","aliases":["CVE-2024-6874"],"summary":"macidn punycode buffer overread","details":"libcurl's URL API function\n[curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode\nconversions, to and from IDN. Asking to convert a name that is exactly 256\nbytes, libcurl ends up reading outside of a stack based buffer when built to\nuse the *macidn* IDN backend. The conversion function then fills up the\nprovided buffer exactly - but does not null-terminate the string.\n\nThis flaw can lead to stack contents accidentally getting returned as part of\nthe converted string.","affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"8.8.0"},{"fixed":"8.9.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"add22feeef07858307be5722e1869e082554290e"},{"fixed":"686d54baf1df6e0775898f484d1670742898b3b2"}]}],"versions":["8.8.0","curl-8_8_0"],"database_specific":{"source":"https://curl.se/docs/CURL-CVE-2024-6874.json","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"216640968448479456553636563154165417207","length":575},"id":"CURL-CVE-2024-6874-6c58f535","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/686d54baf1df6e0775898f484d1670742898b3b2","target":{"file":"lib/idn.c","function":"mac_idn_to_ascii"}},{"deprecated":false,"digest":{"function_hash":"172764687688659853305595737277601779273","length":577},"id":"CURL-CVE-2024-6874-dfa7777d","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/686d54baf1df6e0775898f484d1670742898b3b2","target":{"file":"lib/idn.c","function":"mac_ascii_to_idn"}},{"deprecated":false,"digest":{"line_hashes":["98002545464681941635236377462148785051","232850703124931391163673421933204740841","112771001505927567012460810966684188462","248033720349314409798132084819429479132","113651119734714053058587916180594786732","232306955307703962923429757053563269400","101837938303599049161117334065762530211","248033720349314409798132084819429479132"],"threshold":0.9},"id":"CURL-CVE-2024-6874-e762d376","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/686d54baf1df6e0775898f484d1670742898b3b2","target":{"file":"lib/idn.c"}}],"vanir_signatures_modified":"2026-05-27T02:29:29Z"}}],"database_specific":{"CWE":{"desc":"Buffer Over-read","id":"CWE-126"},"URL":"https://curl.se/docs/CVE-2024-6874.json","affects":"lib","award":{"amount":"540","currency":"USD"},"issue":"https://hackerone.com/reports/2604391","last_affected":"8.8.0","package":"curl","severity":"Low","www":"https://curl.se/docs/CVE-2024-6874.html"},"credits":[{"name":"z2_","type":"FINDER"},{"name":"z2_","type":"REMEDIATION_DEVELOPER"}]}