CVE-2023-38039 — Allocation of Resources Without Limits or Throttling in Curl
Severity
7.5HIGHNVD
EPSS
12.3%
top 6.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedSep 15
Latest updateJan 22
Description
When curl retrieves an HTTP response, it stores the incoming headers so that
they can be accessed later via the libcurl headers API.
However, curl did not have a limit in how many or how large headers it would
accept in a response, allowing a malicious server to stream an endless series
of headers and eventually cause curl to run out of heap memory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6
Affected Packages11 packages
Also affects: Fedora 37, 38, 39
Patches
🔴Vulnerability Details
4OSV▶
CVE-2023-38039: When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API↗2023-09-15
OSV▶
CVE-2023-38039: When curl retrieves an HTTP response, it stores the incoming headers so that
they can be accessed later via the libcurl headers API↗2023-09-15
GHSA▶
GHSA-99j9-jf36-9747: When curl retrieves an HTTP response, it stores the incoming headers so that
they can be accessed later via the libcurl headers API↗2023-09-15
CVEList▶
CVE-2023-38039: When curl retrieves an HTTP response, it stores the incoming headers so that
they can be accessed later via the libcurl headers API↗2023-09-15
📋Vendor Advisories
9Oracle▶
Oracle Oracle Database Server Risk Matrix: Oracle Spatial and Graph (cURL) — CVE-2023-38039↗2023-10-15