What’s Vulnerable › Vulnerabilities

CVE-2023-46219

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-12-12 · updated 2026-06-17
• Weakness: CWE-311

Description

When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.

Affected products

• Fedoraproject Fedora: 38
• curl: from 7.84.0 before 8.5.0 — fixed in 8.5.0

How to fix

Upgrade to a fixed version: curl 8.5.0. Check the vendor advisory for mitigations.

References

• https://curl.se/docs/CVE-2023-46219.html
• https://hackerone.com/reports/2236133
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/
• https://security.netapp.com/advisory/ntap-20240119-0007/
• https://www.debian.org/security/2023/dsa-5587
• https://curl.se/docs/CVE-2023-46219.html
• https://hackerone.com/reports/2236133
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ZX3VW67N4ACRAPMV2QS2LVYGD7H2MVE/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/
• https://security.netapp.com/advisory/ntap-20240119-0007/
• https://www.debian.org/security/2023/dsa-5587
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Get alerted when CVE-2023-46219 or the next vulnerability affects your stack