CURL-CVE-2023-23916

See a problem?
Please try reporting it to the source first.
Source
https://curl.se/docs/CVE-2023-23916.html
Import Source
https://curl.se/docs/CURL-CVE-2023-23916.json
JSON Data
https://api.test.osv.dev/v1/vulns/CURL-CVE-2023-23916
Aliases
Published
2023-02-15T08:00:00Z
Modified
2025-05-15T17:48:29Z
Summary
HTTP multi-header compression denial of service
Details

curl supports "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was capped, but the cap was implemented on a per-header basis allowing a malicious server to insert a virtually unlimited number of compression steps simply by using many headers.

The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.

Database specific 
{
    "issue": "https://hackerone.com/reports/1826048",
    "CWE": {
        "desc": "Allocation of Resources Without Limits or Throttling",
        "id": "CWE-770"
    },
    "URL": "https://curl.se/docs/CVE-2023-23916.json",
    "award": {
        "currency": "USD",
        "amount": "2400"
    },
    "package": "curl",
    "severity": "Medium",
    "last_affected": "7.87.0",
    "affects": "both",
    "www": "https://curl.se/docs/CVE-2023-23916.html"
}
References
Credits
    • Patrick Monnerat - FINDER
    • Patrick Monnerat - REMEDIATION_DEVELOPER

Affected packages

Git / github.com/curl/curl.git

Affected ranges

Type
SEMVER
Events
Introduced
7.57.0
Fixed
7.88.0
Type
GIT
Repo
https://github.com/curl/curl.git
Events
Introduced
dbcced8e32b50c068ac297106f0502ee200a1ebd
Fixed
119fb187192a9ea13dc90d9d20c215fc82799ab9

Affected versions

7.*

7.57.0
7.58.0
7.59.0
7.60.0
7.61.0
7.61.1
7.62.0
7.63.0
7.64.0
7.64.1
7.65.0
7.65.1
7.65.2
7.65.3
7.66.0
7.67.0
7.68.0
7.69.0
7.69.1
7.70.0
7.71.0
7.71.1
7.72.0
7.73.0
7.74.0
7.75.0
7.76.0
7.76.1
7.77.0
7.78.0
7.79.0
7.79.1
7.80.0
7.81.0
7.82.0
7.83.0
7.83.1
7.84.0
7.85.0
7.86.0
7.87.0

Database specific 

{
    "vanir_signatures": [
        {
            "target": {
                "file": "lib/content_encoding.c",
                "function": "Curl_build_unencoding_stack"
            },
            "digest": {
                "function_hash": "236136722379571766480436126468880933004",
                "length": 1391.0
            },
            "signature_type": "Function",
            "signature_version": "v1",
            "deprecated": false,
            "id": "CURL-CVE-2023-23916-04d4e0af",
            "source": "https://github.com/curl/curl.git/commit/119fb187192a9ea13dc90d9d20c215fc82799ab9"
        },
        {
            "target": {
                "file": "lib/content_encoding.c"
            },
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "225682655952001326715220674207391006600",
                    "285785662562700632386988265942516493028",
                    "203103347077643510629770777772191475331",
                    "281980678149956129927863230221465799883",
                    "114552470392839331261066750353470777076",
                    "309703287710777946316441318192642982340",
                    "226005546279310649221062165644729979516",
                    "269037724858927312323434386765073202848",
                    "318480930092771807115527444739740201889",
                    "13531748173703579674894831209765224433"
                ]
            },
            "signature_type": "Line",
            "signature_version": "v1",
            "deprecated": false,
            "id": "CURL-CVE-2023-23916-399d64d5",
            "source": "https://github.com/curl/curl.git/commit/119fb187192a9ea13dc90d9d20c215fc82799ab9"
        },
        {
            "target": {
                "file": "lib/urldata.h"
            },
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "314691222874946517552656372691008466937",
                    "169853910395093266110753057715160474849",
                    "189328306042192910930881936581626190490",
                    "27503069412827551803451655498114064704"
                ]
            },
            "signature_type": "Line",
            "signature_version": "v1",
            "deprecated": false,
            "id": "CURL-CVE-2023-23916-d069efcb",
            "source": "https://github.com/curl/curl.git/commit/119fb187192a9ea13dc90d9d20c215fc82799ab9"
        }
    ]
}