What’s Vulnerable › Vulnerabilities
CVE-2023-38039
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 56.4% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2023-09-15 · updated 2026-06-17
- Weakness: CWE-770
Description
When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.
Affected products
- Fedoraproject Fedora: 37, 38, 39
- curl: from 7.84.0 before 8.3.0 — fixed in 8.3.0
- Microsoft Windows 10: before 10.0.17763.5122 — fixed in 10.0.17763.5122
- Microsoft Windows 10: before 10.0.19044.3693 — fixed in 10.0.19044.3693
- Microsoft Windows 10: before 10.0.19045.3693 — fixed in 10.0.19045.3693
- Microsoft Windows 11 21H2: before 10.0.22000.2600 — fixed in 10.0.22000.2600
- Microsoft Windows 11: before 10.0.22621.2715 — fixed in 10.0.22621.2715
- Microsoft Windows 11: before 10.0.22631.2715 — fixed in 10.0.22631.2715
- Microsoft Windows Server 2019: before 10.0.17763.5122 — fixed in 10.0.17763.5122
- Microsoft Windows Server 2022: before 10.0.20348.2113 — fixed in 10.0.20348.2113
- curl: from 8.3.0 before 8.3.0 — fixed in 8.3.0
How to fix
Upgrade to a fixed version: curl 8.3.0; Microsoft Windows 10 10.0.17763.5122; Microsoft Windows 10 10.0.19044.3693; Microsoft Windows 10 10.0.19045.3693; Microsoft Windows 11 21H2 10.0.22000.2600; Microsoft Windows 11 10.0.22621.2715; Microsoft Windows 11 10.0.22631.2715; Microsoft Windows Server 2019 10.0.17763.5122; Microsoft Windows Server 2022 10.0.20348.2113; curl 8.3.0. Check the vendor advisory for mitigations.
References
- http://seclists.org/fulldisclosure/2023/Oct/17
- http://seclists.org/fulldisclosure/2024/Jan/34
- http://seclists.org/fulldisclosure/2024/Jan/37
- http://seclists.org/fulldisclosure/2024/Jan/38
- https://hackerone.com/reports/2072338
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DCZMYODALBLVOXVJEN2LF2MLANEYL4F/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6KGKB2JNZVT276JYSKI6FV2VFJUGDOJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEAWTYHC3RT6ZRS5OZRHLAIENVN6CCIS/
- https://security.gentoo.org/glsa/202310-12
- https://security.netapp.com/advisory/ntap-20231013-0005/
- https://support.apple.com/kb/HT214036
- https://support.apple.com/kb/HT214057
Get alerted when CVE-2023-38039 or the next vulnerability affects your stack