CVE-2023-38039

2023-09-1300:00:00

ubuntu.com

curl

http response

header limit

vulnerability

malicious server

heap memory

unix

cve-2023-38039

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.009 Low

EPSS

Percentile

83.1%

JSON

When curl retrieves an HTTP response, it stores the incoming headers so
that they can be accessed later via the libcurl headers API. However, curl
did not have a limit in how many or how large headers it would accept in a
response, allowing a malicious server to stream an endless series of
headers and eventually cause curl to run out of heap memory.

Notes

Author	Note
alexmurray	Vulnerable code exists since 7.83.0 but was an experimental feature not enabled by default and only enabled in 7.84.0. Fixed in upstream release 8.3.0.

OSVersionArchitecturePackageVersionFilename
ubuntu23.04noarchcurl< 7.88.1-8ubuntu2.2UNKNOWN
ubuntu23.10noarchcurl< 8.2.1-1ubuntu3UNKNOWN
ubuntu24.04noarchcurl< 8.2.1-1ubuntu3UNKNOWN