CVE-2023-38039Allocation of Resources Without Limits or Throttling in Curl

Severity
7.5HIGHNVD
EPSS
12.3%
top 6.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedSep 15
Latest updateJan 22

Description

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages11 packages

CVEListV5curl/curl8.3.08.3.0
NVDhaxx/curl7.84.08.3.0
Alpinehaxx/curl< 8.3.0-r0+8
Debianhaxx/curl< 7.88.1-10+deb12u3+2
NVDmicrosoft/windows< 10.0.17763.5122+1

Also affects: Fedora 37, 38, 39

Patches

🔴Vulnerability Details

4
OSV
CVE-2023-38039: When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API2023-09-15
OSV
CVE-2023-38039: When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API2023-09-15
GHSA
GHSA-99j9-jf36-9747: When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API2023-09-15
CVEList
CVE-2023-38039: When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API2023-09-15

📋Vendor Advisories

9
Apple
CVE-2023-38039: macOS Monterey 12.7.32024-01-22
Apple
CVE-2023-38039: macOS Ventura 13.6.42024-01-22
Apple
CVE-2023-38039: macOS Sonoma 14.22023-12-11
Oracle
Oracle Oracle Database Server Risk Matrix: Oracle Spatial and Graph (cURL) — CVE-2023-380392023-10-15
Microsoft
Hackerone: CVE-2023-38039 HTTP headers eat all memory2023-10-10
CVE-2023-38039 — Curl vulnerability | cvebase