CVE-2024-2004: Usage of disabled protocol
Vulnerability summary
CVE-2024-2004 is a low (CVSS 3.5) Interpretation Conflict vulnerability in apple macos. EPSS estimates a 1.68% chance of exploitation in the next 30 days, higher than 76.9% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 3.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 11 · Related 11Timeline
- 27-03-2024PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · AlpineEcosystem advisory · calculated3.5LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated3.5LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated3.5LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated3.5LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated3.5LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
- NVDNIST3.5LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
EPSS trend
Probability
1.68%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.68% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard2 products
- curl< 8.7.1-r0
- libcurl4All versions (No fix recorded)
Wolfi2 products
- curl< 8.7.1-r0
- libcurl4All versions (No fix recorded)
Alpine1 product
- curl≥ 7.85.0, < 8.7.1-r0
Apple1 product
- macos< 12.7.6 | ≥ 13.0, < 13.6.8 | ≥ 14.0, < 14.6
Curl1 product
- curl8.6.0 | 8.5.0 | 8.4.0 | 8.3.0 | 8.2.1 | 8.2.0 | 8.1.2 | 8.1.1 | 8.1.0 | 8.0.1 | 8.0.0 | 7.88.1 | 7.88.0 | 7.87.0 | 7.86.0 | 7.85.0
Debian1 product
- curl< 7.88.1-10+deb12u6 | < 8.7.1-1
Fedoraproject1 product
- fedoraEOL39 | 40
Haxx1 product
- curl≥ 7.85.0, < 8.7.0
Ubuntu1 product
- curl< 8.5.0-2ubuntu10.1
10 vendors · 18 products
