CVE-2023-38039

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-38039
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-38039.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-38039
Aliases
Downstream
ALPINE (1)
AZL (3)
BELL (1)
CGA (1)
CLEANSTART (7)
DEBIAN (1)
ECHO (1)
JLSEC (1)
MGASA (1)
openSUSE (1)
RHSA (1)
SUSE (2)
UBUNTU (1)
Related
openSUSE (1)
SUSE (2)
Published
2023-09-15T03:21:54Z
Modified
2026-10-16T02:53:51Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API.

However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.

Database specific 
{
    "cna_assigner": "hackerone",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38039.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "8.3.0"
                        },
                        {
                            "last_affected": "8.3.0"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandaloneSingleVersion"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/curl/curl

Affected ranges

Type
GIT
Repo
https://github.com/curl/curl
Events
Introduced
45ac4d019475df03562fe0ac54eb67e1d1de0ca7
Fixed
6fa1d817e5b1a00d7d0c8168091877476b499317
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.84.0"
                },
                {
                    "fixed": "8.3.0"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

Other
curl-7_84_0
curl-7_85_0
curl-7_86_0
curl-7_87_0
curl-7_88_0
curl-7_88_1
curl-8_0_0
curl-8_0_1
curl-8_1_0
curl-8_1_1
curl-8_1_2
curl-8_2_0
curl-8_2_1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-38039.json"