6.5

CVE-2024-2466: TLS certificate check bypass with mbedTLS

Modified
AliasesALPINE-CVE-2024-2466DEBIAN-CVE-2024-2466CGA-67vq-5fv9-wf25
Published 27-03-2024Last modified 15-10-2026

Vulnerability summary

CVE-2024-2466 is a medium (CVSS 6.5) vulnerability in apple macos. EPSS estimates a 1.45% chance of exploitation in the next 30 days, higher than 73.4% of scored vulnerabilities. 2 public exploits are recorded.

Priority
Routine

Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
1.45%
0%100%
Low · +0.12 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits2reference

Advisory lineage

Upstream 0 · Downstream 4 · Related 4
MGASA-2024-0099OPENSUSE-SU-2024:13805-1RHSA-2024:2693SUSE-SU-2025:20029-1CGA-9CH7-64C5-2FFRCGA-HX4M-3Q2W-96WJ

Timeline

  1. 27-03-2024
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

1.45%

Chance of exploitation in the next 30 days

Percentile

73%

Versus all other CVEs

30-day change

Increase +0.12 pp

From 1.33% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found
  • referenceUnverified

    Exploit Reference (hackerone.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (vicarius.io)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Netapp5 products
Chainguard2 products
  • curl< 8.7.1-r0
  • libcurl4All versions (No fix recorded)
Wolfi2 products
  • curl< 8.7.1-r0
  • libcurl4All versions (No fix recorded)
Alpine1 product
  • curl≥ 8.5.0, < 8.7.1-r0
Apple1 product
  • macos< 12.7.6 | ≥ 13.0, < 13.6.8 | ≥ 14.0, < 14.6
Curl1 product
Debian1 product
  • curl< 8.7.1-1
Haxx1 product
  • curl≥ 8.5.0, < 8.7.0

8 vendors · 14 products

References

19 links
Show all 19 references