Log in Start free

Vulnerability · Published Sep 15, 2023 · Assigned by hackerone

CVE-2023-38039

High 7.5

In plain English

A high-severity resource allocation without limits in curl from curl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 56.2% (higher than 99.1% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)56.2%top 0.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20curl8.3.0-r0ALPINE-CVE-2023-38039
Alpine:v3.21curl8.3.0-r0ALPINE-CVE-2023-38039
Alpine:v3.22curl8.3.0-r0ALPINE-CVE-2023-38039
Alpine:v3.23curl8.3.0-r0ALPINE-CVE-2023-38039
Alpine:v3.24curl8.3.0-r0ALPINE-CVE-2023-38039
Debian:12curl7.88.1-10+deb12u3DEBIAN-CVE-2023-38039
Debian:13curl8.3.0-1DEBIAN-CVE-2023-38039
Debian:14curl8.3.0-1DEBIAN-CVE-2023-38039
Ubuntu:24.04:LTScurl8.2.1-1ubuntu3UBUNTU-CVE-2023-38039

Affected products (as reported)

VendorProductVersions
curl curl 8.3.0 – before 8.3.0

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References