CVE-2024-9681

What it actually does

The vulnerability allows a subdomain's HSTS expiry time to overwrite the parent domain's cache entry in curl's HSTS cache, resulting in incorrect expiration times for HTTPS enforcement on the parent domain.

Why it matters to the business

Organizations relying on curl for secure HTTP transfers may face connection failures or unintended use of insecure HTTP when HSTS is enabled, potentially disrupting operations or exposing traffic.

How an attack unfolds

An attacker controlling a subdomain responds with a Strict-Transport-Security header that causes its expiry to bleed into the parent domain's cache entry, altering the intended HSTS behavior for the parent domain on subsequent accesses.

How to fix it

Upgrade curl to the version containing commit b1ef0e1a01c0bb6ee5367bd9c186a603bde3615a or later.

How to confirm the fix worked

Verify the installed curl version includes the fix commit or test HSTS cache behavior with subdomains and parent domains to confirm correct expiry isolation.

Typical attack path

1. Control a subdomain of a target domain
2. Serve HSTS header with crafted max-age from subdomain
3. Trigger cache overwrite for parent domain entry
4. Cause parent domain to enforce incorrect HTTPS timeout leading to failures or downgrade

How to detect it

Review curl debug logs or HSTS cache files for unexpected expiry timestamps on parent domains after subdomain accesses; no widespread exploitation indicators exist given the low EPSS and non-KEV status.

What your security team should do

• Update curl to the fixed version as soon as possible
• Audit all applications and scripts using curl with HSTS enabled
• Test HSTS cache behavior in staging environments before deployment