Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2024-2004

17
FAUCET Score

CVE-2024-2004 is a low-severity logic error in curl that allows a disabled protocol to be used if all protocols are explicitly disabled without adding any. This affects products from Apple, Fedora Project, Haxx, and NetApp. The vulnerability has a CVSS score of 3.5 (LOW), indicating a network attack vector with low complexity, requiring user interaction, and resulting in low confidentiality impact. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
>= 7.85.0, < 8.7.0CPE matchmatch criteria
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
39CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
40CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
< 12.7.6CPE matchmatch criteria
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
>= 13.0, < 13.6.8CPE matchmatch criteria
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

3.5LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
2.1
Impact Score
1.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.68%
Probability of exploitation in next 30 days
EPSS Percentile
74.5%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0168 is in the 99th percentile among its peer group of 404 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.2 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (58)

denopatch availablevia llm_extracted
View patch
hikvisionpatch availablevia llm_extracted
keraspatch availablevia llm_extracted
View patch
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 ARMFixed in: 8.0.40-1
microsoftpatch availablevia msrc
Product: azl3 cmake 3.29.6-1 on Azure Linux 3.0Fixed in: 3.30.3-2
microsoftpatch availablevia msrc
Product: 17218-16823Fixed in: 8.0.40-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 x64Fixed in: 8.0.40-1
microsoftpatch availablevia msrc
Product: 17629-17084Fixed in: 8.8.0-1
microsoftpatch availablevia msrc
Product: 19736-17086Fixed in: 8.8.0-1
microsoftpatch availablevia msrc
Product: 19742-17084Fixed in: 8.8.0-1
microsoftpatch availablevia msrc
Product: 17628-17084Fixed in: 3.30.3-2
microsoftpatch availablevia msrc
Product: 17734-17084Fixed in: 3.30.3-2
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 8.8.0-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 8.0.40-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 8.8.0-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 8.0.40-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 x64Fixed in: 3.30.3-2
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 x64Fixed in: 8.8.0-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 ARMFixed in: 3.30.3-2
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 ARMFixed in: 8.8.0-1
microsoftpatch availablevia msrc
Product: cbl2 mysql 8.0.40-1 on CBL Mariner 2.0Fixed in: 8.0.40-1
microsoftpatch availablevia msrc
Product: azl3 mysql 8.0.40-1 on Azure Linux 3.0Fixed in: 8.0.40-1
microsoftpatch availablevia msrc
Product: azl3 mysql 8.0.36-1 on Azure Linux 3.0Fixed in: 8.0.40-1
microsoftpatch availablevia msrc
Product: cbl2 mysql 8.0.36-1 on CBL Mariner 2.0Fixed in: 8.0.40-1
microsoftpatch availablevia msrc
Product: cbl2 curl 8.8.0-1 on CBL Mariner 2.0Fixed in: 8.8.0-1
microsoftpatch availablevia msrc
Product: azl3 curl 8.8.0-1 on Azure Linux 3.0Fixed in: 8.8.0-1
microsoftpatch availablevia msrc
Product: cbl2 curl 8.5.0-2 on CBL Mariner 2.0Fixed in: 8.8.0-1
microsoftpatch availablevia msrc
Product: azl3 curl 8.5.0-1 on Azure Linux 3.0Fixed in: 8.8.0-1
microsoftpatch availablevia msrc
Product: azl3 cmake 3.30.3-2 on Azure Linux 3.0Fixed in: 3.30.3-2
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 x64Fixed in: 8.0.40-2
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 ARMFixed in: 8.0.40-2
microsoftpatch availablevia msrc
Product: 17607-17084Fixed in: 8.0.40-1
microsoftpatch availablevia msrc
Product: 19690-17084Fixed in: 8.0.40-1
microsoftpatch availablevia msrc
Product: 19677-17086Fixed in: 8.0.40-1
microsoftpatch availablevia msrc
Product: 17235-17086Fixed in: 8.0.40-1
microsoftpatch availablevia msrc
Product: 17271-16823Fixed in: 8.8.0-1
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-mod_jk-0:1.2.49-6.redhat_1.el8jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-mod_md-1:2.4.24-6.el8jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-mod_proxy_cluster-0:1.3.20-4.el8jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-mod_security-0:2.9.3-36.el8jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-nghttp2-0:1.43.0-13.el8jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-curl-0:8.7.1-2.el7jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-httpd-0:2.4.57-10.el7jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_http2-0:1.15.19-37.el7jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_jk-0:1.2.49-6.redhat_1.el7jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_md-1:2.4.24-6.el7jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_proxy_cluster-0:1.3.20-4.el7jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_security-0:2.9.3-36.el7jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-nghttp2-0:1.43.0-13.el7jbcs
View patch
redhatpatch availablevia redhat_api
Product: Text-Only JBCSFixed in: jbcs-httpd24-curl
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-mod_http2-0:1.15.19-37.el8jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-httpd-0:2.4.57-10.el8jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-curl-0:8.7.1-2.el8jbcs
View patch
applevendor investigatingvia nvd_reference
View patch
bentomlvendor investigatingvia llm_extracted
broadcomvendor investigatingvia llm_extracted
honeywellvendor investigatingvia llm_extracted
pjsipvendor investigatingvia llm_extracted

Vendor Advisories (12)

microsoft2024-Dec/CVE-2024-2004

CVE-2024-2004

Dec 10, 2024
microsoft2024-Nov/CVE-2024-2004

CVE-2024-2004

Nov 12, 2024
microsoft2024-Oct/CVE-2024-2004

CVE-2024-2004

Oct 8, 2024
pjsipllm-pjsip-056d9a9a0ed47fd4HIGH

Multiple Curl vulnerabilities in the Git for Windows component of Bosch DIVAR IP all-in-one Devices

Aug 7, 2024
broadcomllm-broadcom-779921ba709d876dHIGH

Multiple Curl vulnerabilities in the Git for Windows component of Bosch DIVAR IP all-in-one Devices

Aug 7, 2024
bentomlllm-bentoml-afc9bdbe6a0e2087HIGH

Multiple Curl vulnerabilities in the Git for Windows component of Bosch DIVAR IP all-in-one Devices

Aug 7, 2024
honeywellllm-honeywell-2b8544b5763a5d17HIGH

Multiple Curl vulnerabilities in the Git for Windows component of Bosch DIVAR IP all-in-one Devices

Aug 7, 2024
kerasllm-keras-7d8c31fee70361dcCRITICAL

HP ThinPro 8.0 SP 9 Security Updates

Jun 17, 2024
denollm-deno-b67a3af2ce0be075CRITICAL

HP ThinPro 8.0 SP 9 Security Updates

Jun 17, 2024
hikvisionllm-hikvision-3232a3add379161cLOW

Usage of disabled protocol

Mar 27, 2024
redhatCVE-2024-2004Low

curl: Usage of disabled protocol

Mar 27, 2024
microsoft2024-Mar/CVE-2024-2004Low

Usage of disabled protocol

Mar 12, 2024

References

curl.se / docs/CVE-2024-2004.html
Vendor Advisory
curl.se / docs/CVE-2024-2004.json
Vendor Advisory
seclists.org / fulldisclosure/2024/Jul/18
Mailing ListThird Party Advisory
seclists.org / fulldisclosure/2024/Jul/19
Mailing ListThird Party Advisory
seclists.org / fulldisclosure/2024/Jul/20
Mailing ListThird Party Advisory
hackerone.com / reports/2384833
ExploitIssue TrackingThird Party Advisory
lists.fedoraproject.org / archives/list/[email protected]/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6
Third Party Advisory
lists.fedoraproject.org / archives/list/[email protected]/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI
Third Party Advisory
security.netapp.com / advisory/ntap-20240524-0006
Third Party Advisory
support.apple.com / kb/HT214118
Release NotesVendor Advisory
support.apple.com / kb/HT214119
Release NotesVendor Advisory
support.apple.com / kb/HT214120
Release NotesVendor Advisory
openwall.com / lists/oss-security/2024/03/27/1
Mailing ListThird Party Advisory