When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.) When `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain's expiry timeout *bleed over* and get set for the parent domain `example.com` in curl's HSTS cache. The result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different period of time than what was asked for by the origin server. If `example.com` for example stops supporting HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set) timeout expires. This bug can also expire the parent's entry *earlier*, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache     entry, making it end sooner or later than otherwise intended. This affects curl using applications that     enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like     `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS     cache either needs to have been populated manually or there needs to have been previous HTTPS accesses     done as the cache needs to have entries for the domains involved to trigger this problem.) When     `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain's     expiry timeout *bleed over* and get set for the parent domain `example.com` in curl's HSTS cache. The     result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different     period of time than what was asked for by the origin server. If `example.com` for example stops supporting     HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set)     timeout expires. This bug can also expire the parent's entry *earlier*, thus making curl inadvertently     switch back to insecure HTTP earlier than otherwise intended.(CVE-2024-9681)

Tenable has extracted the preceding description block directly from the EulerOS curl security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cmake / curl / mysql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-9681 advisory.

  - When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache     entry, making it end sooner or later than otherwise intended. This affects curl using applications that     enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like     `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS     cache either needs to have been populated manually or there needs to have been previous HTTPS accesses     done as the cache needs to have entries for the domains involved to trigger this problem.) When     `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain's     expiry timeout *bleed over* and get set for the parent domain `example.com` in curl's HSTS cache. The     result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different     period of time than what was asked for by the origin server. If `example.com` for example stops supporting     HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set)     timeout expires. This bug can also expire the parent's entry *earlier*, thus making curl inadvertently     switch back to insecure HTTP earlier than otherwise intended. (CVE-2024-9681)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cmake / curl / mysql installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-9681 advisory.

  - When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache     entry, making it end sooner or later than otherwise intended. This affects curl using applications that     enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like     `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS     cache either needs to have been populated manually or there needs to have been previous HTTPS accesses     done as the cache needs to have entries for the domains involved to trigger this problem.) When     `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain's     expiry timeout *bleed over* and get set for the parent domain `example.com` in curl's HSTS cache. The     result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different     period of time than what was asked for by the origin server. If `example.com` for example stops supporting     HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set)     timeout expires. This bug can also expire the parent's entry *earlier*, thus making curl inadvertently     switch back to insecure HTTP earlier than otherwise intended. (CVE-2024-9681)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is prior to 8.3.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2724 advisory.

    When curl is asked to use HSTS, the expiry time for a subdomain mightoverwrite a parent domain's cache     entry, making it end sooner or later thanotherwise intended.

    This affects curl using applications that enable HSTS and use URLs with theinsecure `HTTP://` scheme and     perform transfers with hosts like`x.example.com` as well as `example.com` where the first host is a     subdomainof the second host.

    (The HSTS cache either needs to have been populated manually or there needs tohave been previous HTTPS     accesses done as the cache needs to have entries forthe domains involved to trigger this problem.)

    When `x.example.com` responds with `Strict-Transport-Security:` headers, thisbug can make the subdomain's     expiry timeout *bleed over* and get set for theparent domain `example.com` in curl's HSTS cache.

    The result of a triggered bug is that HTTP accesses to `example.com` getconverted to HTTPS for a different     period of time than what was asked for bythe origin server. If `example.com` for example stops supporting     HTTPS at itsexpiry time, curl might then fail to access `http://example.com` until the(wrongly set)     timeout expires. This bug can also expire the parent's entry*earlier*, thus making curl inadvertently     switch back to insecure HTTP earlierthan otherwise intended. (CVE-2024-9681)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-a94430d221 advisory.

    - fix HSTS subdomain overwrites parent cache entry (CVE-2024-9681)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2024:3927-2 advisory.

    - CVE-2024-9681: Fixed HSTS subdomain overwrites parent cache entry (bsc#1232528)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7104-1 advisory.

    It was discovered that curl could overwrite the HSTS expiry of the parent domain with the subdomain's HSTS     entry. This could lead to curl switching back to insecure HTTP earlier than otherwise intended, resulting     in information exposure.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The version of Curl installed on the remote host is between 7.74.0 and prior to 8.10.1. It is, therefore, affected by a potential minor DoS security problem when trying to use HTTPS when that no longer works or a cleartext transmission of data that was otherwise intended to possibly be protected.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2024:3927-1 advisory.

    - CVE-2024-9681: Fixed HSTS subdomain overwrites parent cache entry (bsc#1232528)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3925-1 advisory.

    - CVE-2024-9681: Fixed HSTS subdomain overwrites parent cache entry (bsc#1232528)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3926-1 advisory.

    - CVE-2024-9681: Fixed HSTS subdomain overwrites parent cache entry (bsc#1232528)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
216007	EulerOS 2.0 SP12 : curl (EulerOS-SA-2025-1170)	Nessus	Huawei Local Security Checks	medium
215977	EulerOS 2.0 SP11 : curl (EulerOS-SA-2025-1151)	Nessus	Huawei Local Security Checks	medium
215976	EulerOS 2.0 SP12 : curl (EulerOS-SA-2025-1186)	Nessus	Huawei Local Security Checks	medium
215975	EulerOS 2.0 SP11 : curl (EulerOS-SA-2025-1132)	Nessus	Huawei Local Security Checks	medium
215540	Azure Linux 3.0 Security Update: cmake / curl / mysql (CVE-2024-9681)	Nessus	Azure Linux Local Security Checks	medium
214799	CBL Mariner 2.0 Security Update: cmake / curl / mysql (CVE-2024-9681)	Nessus	MarinerOS Local Security Checks	medium
213673	Amazon Linux 2 : curl (ALAS-2025-2724)	Nessus	Amazon Linux Local Security Checks	medium
213610	Fedora 41 : curl (2024-a94430d221)	Nessus	Fedora Local Security Checks	medium
213267	SUSE SLES12 Security Update : curl (SUSE-SU-2024:3927-2)	Nessus	SuSE Local Security Checks	medium
211514	Ubuntu 22.04 LTS / 24.04 LTS / 24.10 : curl vulnerability (USN-7104-1)	Nessus	Ubuntu Local Security Checks	medium
210890	Photon OS 3.0: Curl PHSA-2024-3.0-0802	Nessus	PhotonOS Local Security Checks	medium
210755	Photon OS 4.0: Curl PHSA-2024-4.0-0709	Nessus	PhotonOS Local Security Checks	medium
210719	Photon OS 5.0: Curl PHSA-2024-5.0-0392	Nessus	PhotonOS Local Security Checks	medium
210585	Curl 7.74.0 < 8.10.1 Input Misinterpretation (CVE-2024-9681)	Nessus	Misc.	medium
210473	SUSE SLES12 Security Update : curl (SUSE-SU-2024:3927-1)	Nessus	SuSE Local Security Checks	medium
210472	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : curl (SUSE-SU-2024:3925-1)	Nessus	SuSE Local Security Checks	medium
210469	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : curl (SUSE-SU-2024:3926-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2024-9681

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium