CVE-2023-23916
published 2023-02-23CVE-2023-23916: An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that…
PriorityP431medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
1.70%
74.3th percentile
An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.
Affected
37 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | curl | < curl 7.88.1-1 (bookworm) | curl 7.88.1-1 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| haxx | curl | >= 0 < 7.74.0-1.3+deb11u7 | 7.74.0-1.3+deb11u7 |
| haxx | curl | >= 0 < 7.88.1-1 | 7.88.1-1 |
| haxx | curl | >= 0 < 7.88.1-1 | 7.88.1-1 |
| haxx | curl | >= 0 < 7.88.1-1 | 7.88.1-1 |
| haxx | curl | >= 0 < 7.58.0-2ubuntu3.23 | 7.58.0-2ubuntu3.23 |
| haxx | curl | >= 0 < 7.68.0-1ubuntu2.16 | 7.68.0-1ubuntu2.16 |
| haxx | curl | >= 0 < 7.81.0-1ubuntu1.8 | 7.81.0-1ubuntu1.8 |
| haxx | curl | >= 7.57.0 < 7.88.0 | 7.88.0 |
| https | github.com_curl_curl | — | — |
| msrc | azl3_cmake_3.21.4-10_on_azure_linux_3.0 | — | — |
| msrc | azl3_cmake_3.28.2-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.75.0-14_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.86.0-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.11.1-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_cmake_3.21.4-13_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_curl_7.88.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_mysql_8.0.33-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_rust_1.72.0-2_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv9.1CRITICAL
vendor_ubuntu9.1CRITICAL
vendor_oracle7.5MEDIUM
vendor_debian6.5MEDIUM
vendor_msrc6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Hitachi Energy MSM
cisa_ics·2023-05-09·CVSS 8.8
[HIGH] Hitachi Energy MSM
ICS Advisory
##
Hitachi Energy MSM
Release DateMay 09, 2023
Alert CodeICSA-23-129-02
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Hitachi Energy
- Equipment: Modular Switchgear Monitoring (MSM)
- Vulnerabilities: Improper Restriction of Excessive Authentication Attempts, Authentication Bypass by Capture-replay, Code Injection, Improper Restriction of Operations within the Bounds of a Memory Buffer, NULL Pointer Dereference, Insufficient Entropy
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to obtain user access credentials of the MSM web interface or cause a denial-of-service condition.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following
Oracle
Oracle Oracle Communications Risk Matrix: Configuration (cURL) — CVE-2023-23916
vendor_oracle·2023-04-15·CVSS 7.5
CVE-2023-23916 [MEDIUM] Oracle Oracle Communications Risk Matrix: Configuration (cURL) — CVE-2023-23916
Oracle Oracle Communications Risk Matrix: Configuration (cURL) vulnerability
CVE: CVE-2023-23916
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2023 (APR 2023)
Ubuntu
curl vulnerabilities
vendor_ubuntu·2023-02-27·CVSS 9.1
CVE-2023-23915 [CRITICAL] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
Harry Sintonen discovered that curl incorrectly handled HSTS support
when multiple URLs are requested serially. A remote attacker could possibly
use this issue to cause curl to use unencrypted connections. This issue
only affected Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2023-23914)
Harry Sintonen discovered that curl incorrectly handled HSTS support
when multiple URLs are requested in parallel. A remote attacker could
possibly use this issue to cause curl to use unencrypted connections. This
issue only affected Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2023-23915)
Patrick Monnerat discovered that curl incorrectly handled memory when
processing requests with multi-header compression. A remote attacker could
Red Hat
curl: HTTP multi-header compression denial of service
vendor_redhat·2023-02-15·CVSS 6.5
CVE-2023-23916 [MEDIUM] CWE-770 curl: HTTP multi-header compression denial of service
curl: HTTP multi-header compression denial of service
An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.
A flaw was found in the Curl package. A malicious server can
Microsoft
An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms meaning that a server response can be compressed multip
vendor_msrc·2023-02-14·CVSS 6.5
CVE-2023-23916 [MEDIUM] CWE-770 An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms meaning that a server response can be compressed multip
An allocation of resources without limits or throttling vulnerability exists in curl Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
hackerone: hackerone
Customer Action Required: Yes
Remediation: CBL-Mariner Rel
Debian
CVE-2023-23916: curl - An allocation of resources without limits or throttling vulnerability exists in ...
vendor_debian·2023·CVSS 6.5
CVE-2023-23916 [MEDIUM] CVE-2023-23916: curl - An allocation of resources without limits or throttling vulnerability exists in ...
An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.
Scope: local
bookworm: resolved (fixed in 7.88.1-1)
bullseye: resolved (fixed in 7.74.0-1.3+deb11u7)
forky: resolved
OSV
curl vulnerabilities
osv·2023-02-27·CVSS 9.1
CVE-2023-23914 [CRITICAL] curl vulnerabilities
curl vulnerabilities
Harry Sintonen discovered that curl incorrectly handled HSTS support
when multiple URLs are requested serially. A remote attacker could possibly
use this issue to cause curl to use unencrypted connections. This issue
only affected Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2023-23914)
Harry Sintonen discovered that curl incorrectly handled HSTS support
when multiple URLs are requested in parallel. A remote attacker could
possibly use this issue to cause curl to use unencrypted connections. This
issue only affected Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2023-23915)
Patrick Monnerat discovered that curl incorrectly handled memory when
processing requests with multi-header compression. A remote attacker could
possibly use this issue to cause curl to consume resources,
GHSA
GHSA-v8vq-prc2-j6gx: An allocation of resources without limits or throttling vulnerability exists in curl <v7
ghsa_unreviewed·2023-02-23
CVE-2023-23916 GHSA-v8vq-prc2-j6gx: An allocation of resources without limits or throttling vulnerability exists in curl <v7
An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.
OSV
CVE-2023-23916: An allocation of resources without limits or throttling vulnerability exists in curl <v7
osv·2023-02-23·CVSS 6.5
CVE-2023-23916 [MEDIUM] CVE-2023-23916: An allocation of resources without limits or throttling vulnerability exists in curl <v7
An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.
No detection rules found.
No public exploits indexed.
HackerOne
HTTP multi-header compression denial of service
hackerone·2023-02-24·CVSS 6.5
CVE-2023-23916 [MEDIUM] HTTP multi-header compression denial of service
HTTP multi-header compression denial of service
A server can send an HTTP response with many occurrences of Transfer-Encoding and/or Content-Encoding headers. Each listed encoding allocates a buffer. The number of encodings listed within each header is already limited but the number of headers is not, allowing an HTTP response to consume all available memory.
## Impact
Consumes all available memory, resulting in a DoS.
CVE-2023-23916: HTTP multi-header compression denial of service
Project curl Security Advisory, February 15th 2023
VULNERABILITY
curl supports "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was capped, but the
HackerOne
CVE-2023-23916: HTTP multi-header compression denial of service
hackerone·2023-02-20·CVSS 6.5
CVE-2023-23916 [MEDIUM] CVE-2023-23916: HTTP multi-header compression denial of service
CVE-2023-23916: HTTP multi-header compression denial of service
## Summary:
A server can send an HTTP response with many occurrences of Transfer-Encoding and/or Content-Encoding headers. Each listed encoding allocates a buffer. The number of encodings listed within each header is already bounded but the number of headers is not, allowing an HTTP response to consume all available memory.
## Steps To Reproduce:
Using the curl test environment:
1. Extract test418 from the attached patch
2. runtests.pl 418
## Supporting Material/References:
Patch fixing the problem and new test for the case.
## Impact
Denial of service.
https://hackerone.com/reports/1826048https://lists.debian.org/debian-lts-announce/2023/02/msg00035.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQKE6TXYDHOTFHLTBZ5X73GTKI7II5KO/https://security.gentoo.org/glsa/202310-12https://security.netapp.com/advisory/ntap-20230309-0006/https://www.debian.org/security/2023/dsa-5365https://hackerone.com/reports/1826048https://lists.debian.org/debian-lts-announce/2023/02/msg00035.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQKE6TXYDHOTFHLTBZ5X73GTKI7II5KO/https://security.gentoo.org/glsa/202310-12https://security.netapp.com/advisory/ntap-20230309-0006/https://www.debian.org/security/2023/dsa-5365
2023-02-23
Published