CVE-2023-27537
published 2023-03-30CVE-2023-27537: A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for…
PriorityP430medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
1.86%
78.2th percentile
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | curl | < curl 7.88.1-7 (bookworm) | curl 7.88.1-7 (bookworm) |
| haxx | curl | >= 0 < 7.88.1-7 | 7.88.1-7 |
| haxx | curl | >= 0 < 7.88.1-7 | 7.88.1-7 |
| haxx | curl | >= 0 < 7.88.1-7 | 7.88.1-7 |
| haxx | libcurl | — | — |
| haxx | libcurl | — | — |
| https | github.com_curl_curl | — | — |
| msrc | azl3_cmake_3.21.4-10_on_azure_linux_3.0 | — | — |
| msrc | azl3_cmake_3.28.2-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.75.0-14_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.86.0-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.11.1-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_mysql_8.0.33-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_rust_1.72.0-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_tensorflow_2.11.1-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| netapp | clustered_data_ontap | — | — |
| splunk | universal_forwarder | — | — |
| splunk | universal_forwarder | >= 8.2.0 < 8.2.12 | 8.2.12 |
| splunk | universal_forwarder | >= 9.0.0 < 9.0.6 | 9.0.6 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
osv5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_msrc5.9MEDIUM
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9j2c-vm53-wcvm: A double free vulnerability exists in libcurl <8
ghsa_unreviewed·2023-03-30
CVE-2023-27537 [MEDIUM] CWE-415 GHSA-9j2c-vm53-wcvm: A double free vulnerability exists in libcurl <8
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
OSV
CVE-2023-27537: A double free vulnerability exists in libcurl <8
osv·2023-03-30·CVSS 5.9
CVE-2023-27537 [MEDIUM] CVE-2023-27537: A double free vulnerability exists in libcurl <8
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
CISA ICS
Siemens SINEC NMS
cisa_ics·2024-02-15
Siemens SINEC NMS
ICS Advisory
##
Siemens SINEC NMS
Release DateFebruary 15, 2024
Alert CodeICSA-24-046-15
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC NMS
- Vulnerabilities: Out-of-bounds Read, Inadequate Encryption Strength, Double Free, Use After Free, NULL Pointer Dereference, Improper Input Validation, Missing Encryption of Sensitive Data, Allocation of Resources Wit
Red Hat
curl: HSTS double-free
vendor_redhat·2023-03-20·CVSS 5.9
CVE-2023-27537 [MEDIUM] CWE-415 curl: HSTS double-free
curl: HSTS double-free
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
Package: rh-dotnet31-curl (.NET Core 3.1 on Red Hat Enterprise Linux) - Not affected
Package: curl (Red Hat Enterprise Linux 6) - Not affected
Package: curl (Red Hat Enterprise Linux 7) - Not affected
Package: curl (Red Hat Enterprise Linux 8) - Not affected
Package: curl (Red Hat Enterprise Linux 9) - Not affected
Package: jbcs-httpd24-curl (Red Hat JBoss Core Services) - N
Microsoft
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads b
vendor_msrc·2023-03-14·CVSS 5.9
CVE-2023-27537 [MEDIUM] CWE-415 A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads b
A double free vulnerability exists in libcurl Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
hackerone: hackerone
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microso
Debian
CVE-2023-27537: curl - A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data betw...
vendor_debian·2023·CVSS 5.9
CVE-2023-27537 [MEDIUM] CVE-2023-27537: curl - A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data betw...
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
Scope: local
bookworm: resolved (fixed in 7.88.1-7)
bullseye: resolved
forky: resolved (fixed in 7.88.1-7)
sid: resolved (fixed in 7.88.1-7)
trixie: resolved (fixed in 7.88.1-7)
No detection rules found.
No public exploits indexed.
HackerOne
CVE-2023-27537: HSTS double-free
hackerone·2023-03-23·CVSS 5.9
CVE-2023-27537 [MEDIUM] CVE-2023-27537: HSTS double-free
CVE-2023-27537: HSTS double-free
Original Report:https://hackerone.com/reports/1897203
## Impact
Double-free
##CVE-2023-27537: HSTS double-free
libcurl supports sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation.
Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
Security Advisory: https://curl.se/docs/CVE-2023-27537.html
HackerOne
CVE-2023-27537: HSTS double-free
hackerone·2023-03-20·CVSS 5.9
CVE-2023-27537 [MEDIUM] CVE-2023-27537: HSTS double-free
CVE-2023-27537: HSTS double-free
## Summary:
When processing HSTS with multi-threading, double-free or UAF may occur due to lack of exclusion control.
HSTS entries disappear when they expire or when "max-age=0" is received.
In this case, the offending entry is removed from the internal memory list, freeing memory but not exclusivity control.
Therefore, depending on the timing, other threads may perform the operation, resulting in double-free or UAF.
`lib/hsts.c` in the function `Curl_hsts_parse` on lines 213-221
```
if(!expires) {
/* remove the entry if present verbatim (without subdomain match) */
sts = Curl_hsts(h, hostname, FALSE);
if(sts) {
Curl_llist_remove(&h->list, &sts->node, NULL);
hsts_free(sts);
}
return CURLE_OK;
}
```
If multiple threads process `hsts_free(sts);` at the sam
2023-03-30
Published