---
id: CVE-2024-2466
title: >-
  libcurl did not check the server certificate of TLS connections done to a host
  specified as an IP address, when built to use mbedTLS
summary: >-
  libcurl did not check the server certificate of TLS connections done to a host
  specified as an IP address, when built to use mbedTLS.  libcurl would wrongly
  avoid using the set hostname function when the specified hostname was given as
  a…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-297
vendor: haxx
product: curl
affected:
  - 'curl >= 8.5.0, < 8.7.0'
  - macos < 12.7.6
  - 'macos >= 13.0, < 13.6.8'
  - 'macos >= 14.0, < 14.6'
  - h700s_firmware
  - bootstrap_os
  - h300s_firmware
  - h410s_firmware
  - h500s_firmware
patched:
  - curl 8.7.0
  - macos 14.6
published: '2024-03-27'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:17:43.823'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-2466'
references:
  - url: 'http://seclists.org/fulldisclosure/2024/Jul/18'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'http://seclists.org/fulldisclosure/2024/Jul/19'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'http://seclists.org/fulldisclosure/2024/Jul/20'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'http://www.openwall.com/lists/oss-security/2024/03/27/4'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://curl.se/docs/CVE-2024-2466.html'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://curl.se/docs/CVE-2024-2466.json'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://hackerone.com/reports/2416725'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://security.netapp.com/advisory/ntap-20240503-0010/'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://support.apple.com/kb/HT214118'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://support.apple.com/kb/HT214119'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://support.apple.com/kb/HT214120'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'http://seclists.org/fulldisclosure/2024/Jul/18'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://seclists.org/fulldisclosure/2024/Jul/19'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://seclists.org/fulldisclosure/2024/Jul/20'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2024/03/27/4'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://curl.se/docs/CVE-2024-2466.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://curl.se/docs/CVE-2024-2466.json'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://hackerone.com/reports/2416725'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20240503-0010/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://support.apple.com/kb/HT214118'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://support.apple.com/kb/HT214119'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://support.apple.com/kb/HT214120'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://www.vicarius.io/vsociety/posts/tls-certificate-check-bypass-curl-with-mbedtls-cve-2024-2466-2468
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-331112.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-417159.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.01453
epssPercentile: 0.73031
ingestedAt: '2026-10-15T03:30:12.646Z'
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-08-23T18:43:18.887717Z'
---

## Overview

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.  libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).

## Affected

- `curl >= 8.5.0, < 8.7.0`
- `macos < 12.7.6`
- `macos >= 13.0, < 13.6.8`
- `macos >= 14.0, < 14.6`
- `h700s_firmware`
- `bootstrap_os`
- `h300s_firmware`
- `h410s_firmware`
- `h500s_firmware`

## Remediation

Upgrade past the affected range:

- `curl 8.7.0`
- `macos 14.6`