CVE-2024-9681

Medium

Advisory

Published 6 Nov 2024In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.5; base score, highest
EPSS: 0.020; 79th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 502; of 17,787 indexed, latest versions
Container images: 502; deployed by those charts
Fix available: 3 of 3; affected packages

curl-8.11.0-1.1 on GA media

Carried by container images the latest versions of 502 of 17,787 indexed charts deploy, on 502 images.

Affected package	Affected versions	Fixed in	Images
curldeb	7.81.0-1ubuntu1.2, 7.81.0-1ubuntu1.3, 7.81.0-1ubuntu1.4, 7.81.0-1ubuntu1.6+19 more	7.81.0-1ubuntu1.19, 7.88.1-10+deb12u9, 8.5.0-2ubuntu10.5	309
curlapk	8.0.1-r2, 8.1.0-r0, 8.1.1-r1, 8.1.2-r0+13 more	8.11.0-r0	191
curlrpm	7.60.0-lp151.5.6.1	8.11.0-1.1	2

OSV records: ALPINE-CVE-2024-9681 CGA-6vgx-rqv6-p48q DEBIAN-CVE-2024-9681 UBUNTU-CVE-2024-9681 openSUSE-SU-2024:14476-1
Also known as: CGA-f97r-fwm9-2xxp, USN-7104-1

Charts affected

502 by stars

Chart

Latest

Affected images

Radar Score

prometheusalertygqygq2

1.0.0

1 of 1 See more

prometheusalert ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2024-9681.

Container image	Digest	Package	Fixed in
feiyu563/prometheus-alert :v4.9.1	224cfa68cbd9	curl@8.5.0-r0	8.11.0-r0

Open the chart page →

1,611

sockpuppetbrowserzekker6

0.1.0

1 of 1 See more

sockpuppetbrowser zekker6 0.1.0

1 of the 1 container images this version deploys carry CVE-2024-9681.

Container image	Digest	Package	Fixed in
dgtlmoon/sockpuppetbrowser :latest	f166a963b550	curl@8.5.0-r0	8.11.0-r0

Open the chart page →

1,589

Container images carrying it

502 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/maybe-finance/maybe :0.5.0	c6ab95ca9130	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u9	1
ghcr.io/mosn/htnn-controller :v0.3.1	c379e66246be	curl@7.81.0-1ubuntu1.16	7.81.0-1ubuntu1.19	1
ghcr.io/nefelim4ag/pingdom-operator :0.0.15	f8c7afdcf439	curl@7.88.1-10+deb12u6	7.88.1-10+deb12u9	1
ghcr.io/noahburrell0/sealed-secrets-ui :v0.1.4	7e7368fb472d	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u9	1
ghcr.io/onedr0p/prowlarr-develop :1.14.0.4286	c77d84ebf7a6	curl@8.5.0-r0	8.11.0-r0	1
ghcr.io/onedr0p/qbittorrent :4.5.2	0efdd8d3ef39	curl@8.0.1-r2	8.11.0-r0	1
ghcr.io/onedr0p/qbittorrent :4.6.3	a4ad890e8c4a	curl@8.5.0-r0	8.11.0-r0	1
ghcr.io/onedr0p/radarr :5.3.6.8612	8d299e59fce7	curl@8.5.0-r0	8.11.0-r0	1
ghcr.io/onedr0p/sonarr :4.0.2.1183	27ffdcc8a937	curl@8.5.0-r0	8.11.0-r0	1
ghcr.io/opencatalogi/web-app :dev	a1a7f507f6ae	curl@7.88.1-10+deb12u7	7.88.1-10+deb12u9	1
ghcr.io/opencost/opencost-parquet-exporter :v0.2.1	ce85ef0ce665	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u9	1
ghcr.io/open-telemetry/demo :1.12.0-imageprovider	4e322858fe56	curl@7.88.1-10+deb12u6	7.88.1-10+deb12u9	1
ghcr.io/open-telemetry/demo :1.12.0-quoteservice	87eb325d306f	curl@7.88.1-10+deb12u7	7.88.1-10+deb12u9	1
ghcr.io/open-telemetry/demo :1.12.0-adservice	a59e5eead495	curl@8.5.0-2ubuntu10.4	8.5.0-2ubuntu10.5	1
ghcr.io/paperless-ngx/paperless-ngx :2.13.1	0642357c5dbd	curl@7.88.1-10+deb12u7	7.88.1-10+deb12u9	1
ghcr.io/paperless-ngx/paperless-ngx :2.0.1	ab255bea133e	curl@7.88.1-10+deb12u4	7.88.1-10+deb12u9	1
ghcr.io/puckpuck/seashell :1.2	ef5e31333821	curl@8.3.0-r0	8.11.0-r0	1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui :0.2.1-5d668c1	ed07e7ca098d	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u9	1
ghcr.io/tasmoadmin/tasmoadmin :v3.3.2	05aeefbdac2b	curl@8.5.0-r0	8.11.0-r0	1
ghcr.io/voxpupuli/container-puppetdb :7.18.0-v1.5.0	a56dfe91f5b1	curl@7.81.0-1ubuntu1.16	7.81.0-1ubuntu1.19	1
ghcr.io/voxpupuli/container-puppetserver :7.17.0-v1.5.0	916746209ac5	curl@7.81.0-1ubuntu1.16	7.81.0-1ubuntu1.19	1
ghcr.io/vshn/haproxy-with-mysql :1.0.0	a3c27ee3fb2f	curl@7.88.1-10+deb12u1	7.88.1-10+deb12u9	1
ghcr.io/wiremind/grafana-pdf-exporter :v1.7	dbaa8527bf4c	curl@7.88.1-10+deb12u4	7.88.1-10+deb12u9	1
ghcr.io/wizarrrr/wizarr :4.2.0-beta.3	d19d886d5090	curl@7.88.1-10+deb12u6	7.88.1-10+deb12u9	1
ghcr.io/wundergraph/cosmo/otelcollector :0.18.1	5a6fe78d4d15	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u9	1
ghcr.io/wyrihaximusnet/redirect :random	bf5983d754d7	curl@8.10.1-r0	8.11.0-r0	1
ghcr.io/zalando/postgres-operator :v1.12.2	d81cda253f5c	curl@8.7.1-r0	8.11.0-r0	1
ghcr.io/zazuko/blueprint :v0.1.0	92ac2f97978e	curl@8.5.0-r0	8.11.0-r0	1
ghcr.io/zoriya/kyoo_autosync :4.7.1	fbba58ddb1a6	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u9	1
ghcr.io/zoriya/kyoo_back :4.7.1	416e980f76a6	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u9	1
ghcr.io/zoriya/kyoo_scanner :4.7.1	7dc0ee57b628	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u9	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	curl@7.88.1-10+deb12u7	7.88.1-10+deb12u9	1
public.ecr.aws/jtekt-corporation/image-storage-service-gui :v1.9.4	34823c8abe00	curl@7.88.1-10+deb12u7	7.88.1-10+deb12u9	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u9	1
public.ecr.aws/jtekt-corporation/shinsei-manager-front :v1.5.5	f8fb4eea4071	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u9	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	curl@7.88.1-10+deb12u4	7.88.1-10+deb12u9	1
public.ecr.aws/outerbounds/metaflow_metadata_service :v2.4.13	f7567ce3419d	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u9	1
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u9	1
quay.io/aerokube/keygen :1.0.1	578934444f04	curl@7.81.0-1ubuntu1.16	7.81.0-1ubuntu1.19	1
quay.io/argoproj/argocd :v2.4.11	5b6701d8fb31	curl@7.81.0-1ubuntu1.3	7.81.0-1ubuntu1.19	1
quay.io/argoproj/argocd :v2.8.6	acaf37352569	curl@7.81.0-1ubuntu1.14	7.81.0-1ubuntu1.19	1
quay.io/ddn/exascaler-csi-file-driver :v2.2.6	fe2e2e5a2751	curl@8.9.0-r0	8.11.0-r0	1
quay.io/evryfs/spring-boot-admin :2.7.10	60950ef63764	curl@7.81.0-1ubuntu1.6	7.81.0-1ubuntu1.19	1
quay.io/fairwinds/docker-demo :1.4.0	d53cb940196c	curl@8.1.0-r0	8.11.0-r0	1
quay.io/fiware/waltid :1.14.1-SNAPSHOT	93889c3d8a34	curl@7.81.0-1ubuntu1.6	7.81.0-1ubuntu1.19	1
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	curl@7.88.1-10+deb12u1	7.88.1-10+deb12u9	1
quay.io/yushiwho/sys-stats :e1f9d77	8c8d08b95c0b	curl@8.5.0-r0	8.11.0-r0	1
registry.k8s.io/git-sync/git-sync :v4.1.0	fd9722fd02e3	curl@7.88.1-10+deb12u4	7.88.1-10+deb12u9	1
registry.k8s.io/ingress-nginx/controller :v1.10.0	42b3f0e5d084	curl@8.5.0-r0	8.11.0-r0	1
registry.k8s.io/ingress-nginx/controller :v1.8.0	744ae2afd433	curl@8.1.1-r1	8.11.0-r0	1