Strix
26.1K

CVE-2023-38039

HIGHCVSS 7.5/10EPSS 62.25%

Last modified

CVE-2023-38039 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.. EPSS estimates a 62.25% chance of exploitation in the next 30 days.

Description

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
62.25%

99.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
HaxxCurl>= 7.84.0, < 8.3.0
FedoraprojectFedora37
FedoraprojectFedora38
FedoraprojectFedora39
MicrosoftWindows 10 1809< 10.0.17763.5122
MicrosoftWindows 10 21h2< 10.0.19044.3693
MicrosoftWindows 10 22h2< 10.0.19045.3693
MicrosoftWindows 11 21h2< 10.0.22000.2600
MicrosoftWindows 11 22h2< 10.0.22621.2715
MicrosoftWindows 11 23h2< 10.0.22631.2715
MicrosoftWindows Server 2019< 10.0.17763.5122
MicrosoftWindows Server 2022< 10.0.20348.2113

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2023-38039?
When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.
How severe is CVE-2023-38039?
CVE-2023-38039 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 62.25% probability of exploitation in the next 30 days.
How do I fix CVE-2023-38039?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-38039?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST