CVE-2024-9681

Medium

Advisory

Published 6 Nov 2024In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.5; base score, highest
EPSS: 0.020; 79th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 502; of 17,781 indexed, latest versions
Container images: 502; deployed by those charts
Fix available: 3 of 3; affected packages

curl-8.11.0-1.1 on GA media

Carried by container images the latest versions of 502 of 17,781 indexed charts deploy, on 502 images.

Affected package	Affected versions	Fixed in	Images
curldeb	7.81.0-1ubuntu1.2, 7.81.0-1ubuntu1.3, 7.81.0-1ubuntu1.4, 7.81.0-1ubuntu1.6+19 more	7.81.0-1ubuntu1.19, 7.88.1-10+deb12u9, 8.5.0-2ubuntu10.5	309
curlapk	8.0.1-r2, 8.1.0-r0, 8.1.1-r1, 8.1.2-r0+13 more	8.11.0-r0	191
curlrpm	7.60.0-lp151.5.6.1	8.11.0-1.1	2

OSV records: ALPINE-CVE-2024-9681 CGA-6vgx-rqv6-p48q DEBIAN-CVE-2024-9681 UBUNTU-CVE-2024-9681 openSUSE-SU-2024:14476-1
Also known as: CGA-f97r-fwm9-2xxp, USN-7104-1

Charts affected

502 by stars

Chart

Latest

Affected images

Radar Score

prometheusalertygqygq2

1.0.0

1 of 1 See more

prometheusalert ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2024-9681.

Container image	Digest	Package	Fixed in
feiyu563/prometheus-alert :v4.9.1	224cfa68cbd9	curl@8.5.0-r0	8.11.0-r0

Open the chart page →

1,611

sockpuppetbrowserzekker6

0.1.0

1 of 1 See more

sockpuppetbrowser zekker6 0.1.0

1 of the 1 container images this version deploys carry CVE-2024-9681.

Container image	Digest	Package	Fixed in
dgtlmoon/sockpuppetbrowser :latest	f166a963b550	curl@8.5.0-r0	8.11.0-r0

Open the chart page →

1,589

Container images carrying it

502 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
dblaci/ubuntu-ssh-rsync :20231020	eea697611af4	curl@7.81.0-1ubuntu1.14	7.81.0-1ubuntu1.19	1
ddosify/selfhosted_frontend :2.7.4	56dbd7cf0776	curl@8.5.0-r0	8.11.0-r0	1
ddosify/selfhosted_frontend :4.1.5	bf454ab99d89	curl@8.5.0-r0	8.11.0-r0	1
deconzcommunity/deconz :2.29.2	062de2362641	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u9	1
defactops/defactops-ui :1.0.16	825cdf9ba706	curl@8.5.0-r0	8.11.0-r0	1
dgtlmoon/sockpuppetbrowser :latest	f166a963b550	curl@8.5.0-r0	8.11.0-r0	1
dobtc/bitcoin :25.1	a870f7cb1105	curl@7.88.1-10+deb12u4	7.88.1-10+deb12u9	1
domainmod/domainmod :4.23.0	4017bfe4c597	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u9	1
dragonflyoss/client :v0.1.82	edf3e921f4e0	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u9	1
dremio/dremio-oss :24.1.0	80ed2e3b7c43	curl@7.81.0-1ubuntu1.10	7.81.0-1ubuntu1.19	1
drpcorg/dshackle :0.54.0	8858fae1859d	curl@7.81.0-1ubuntu1.16	7.81.0-1ubuntu1.19	1
duck1123/cert-downloader :latest	0e29f19fa67c	curl@7.81.0-1ubuntu1.13	7.81.0-1ubuntu1.19	1
duck1123/lnd-fileserver :latest	9d6fb247b714	curl@7.81.0-1ubuntu1.13	7.81.0-1ubuntu1.19	1
dwdraju/alpine-curl-jq :latest	83bd9be2b14b	curl@8.9.1-r1	8.11.0-r0	1
emqx/ecp-ui :2.5.1	e33e9816f147	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u9	1
epamedp/jenkins-operator :2.15.3	28ef56bc0ca3	curl@8.4.0-r0	8.11.0-r0	1
eqalpha/keydb :alpine_x86_64_v6.3.4	f1d60f12cb3c	curl@8.4.0-r0	8.11.0-r0	1
esphome/esphome :2024.3.0	9ab8cc88b28c	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u9	1
esphome/esphome :2024.12.2	b2c6322700ac	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u9	1
feiyu563/prometheus-alert :v4.9.1	224cfa68cbd9	curl@8.5.0-r0	8.11.0-r0	1
felipecs8/app-db-connection-test :v1	29e06c9c6385	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u9	1
firefart/requesttracker :5.0.4	0d6249906d8c	curl@7.88.1-10+deb12u4	7.88.1-10+deb12u9	1
getmeili/meilisearch :v1.11.0	b9be3d2d4251	curl@8.10.1-r0	8.11.0-r0	1
getsentry/relay :24.10.0	ba7bf9163219	curl@7.88.1-10+deb12u7	7.88.1-10+deb12u9	1
gitea/act_runner :0.2.11-dind-rootless	6120b1165f3a	curl@8.9.1-r2	8.11.0-r0	1
gitea/act_runner :0.2.11	c57233403eff	curl@8.9.1-r2	8.11.0-r0	1
gitea/gitea :1.22.3	76f516a1a8c2	curl@8.10.1-r0	8.11.0-r0	1
gitea/gitea :1.21.6	ac73e0da341f	curl@8.5.0-r0	8.11.0-r0	1
glenndehaan/sunflare-tools :latest	a5b3f1dd865d	curl@8.2.1-r0	8.11.0-r0	1
grafana/grafana :10.1.5	0679e877ba20	curl@8.4.0-r0	8.11.0-r0	1
grafana/grafana :10.1.1	1b9ca4bbc4a2	curl@8.2.1-r0	8.11.0-r0	1
grafana/grafana :11.2.2-security-01	464eac539793	curl@8.10.1-r0	8.11.0-r0	1
grafana/grafana :10.2.3	6b5b37eb35bb	curl@8.5.0-r0	8.11.0-r0	1
grafana/grafana :10.3.3	8640e5038e83	curl@8.5.0-r0	8.11.0-r0	1
grafana/grafana :11.1.3	b23b588cf7cb	curl@8.9.0-r0	8.11.0-r0	1
grafana/grafana :10.4.0	f9811e4e687f	curl@8.5.0-r0	8.11.0-r0	1
gridgain/community :8.9.11	d32d182a0e6a	curl@8.9.1-r1	8.11.0-r0	1
guacamole/guacamole :1.5.5	0f62f6d17ab3	curl@7.81.0-1ubuntu1.15	7.81.0-1ubuntu1.19	1
gulacedia/web-dvwa-new :v3	67b467d961ca	curl@7.88.1-10	7.88.1-10+deb12u9	1
hamzaarshad10/queryfrontend :1.1.5.14	cd359d9a78c3	curl@8.10.1-r0	8.11.0-r0	1
hansehe/graphql-gateway :1.0.4	58e09540afbc	curl@8.5.0-r0	8.11.0-r0	1
haproxytech/kubernetes-ingress :1.11.4	c5f8a41ef0d4	curl@8.5.0-r0	8.11.0-r0	1
hashicorp/consul :1.17.0	712fe02d2f84	curl@8.4.0-r0	8.11.0-r0	1
hashicorp/terraform :1.4	4dcb45513699	curl@8.2.1-r0	8.11.0-r0	1
hashicorp/terraform :1.9.7	b77efab1a448	curl@8.10.1-r0	8.11.0-r0	1
hasura/graphql-engine :v2.34.0-ce	0111b0204136	curl@7.81.0-1ubuntu1.10	7.81.0-1ubuntu1.19	1
hazegoodlife/haaze :veggiesite	50f02d2d5d4d	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u9	1
hazegoodlife/haaze :milksite	8d4c63169e14	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u9	1
hazelcast/hazelcast :5.3.1	8fe26efde8e1	curl@8.2.1-r0	8.11.0-r0	1
hecrom/myweatherangularclient :1.3.11	bb0372939c19	curl@7.88.1-10+deb12u6	7.88.1-10+deb12u9	1