7.5
CWE
770
Advisory Published
CVE Published
Updated

CVE-2023-38039: curl: HTTP headers eat all memory

First published: Wed Sep 13 2023(Updated: )

Curl does not have a limit on the size or quantity of headers it would accept in a response, allowing a malicious server to stream an endless series of headers to a client and eventually cause curl to run out of heap memory.

Credit: support@hackerone.com CVE-2023-38545 CVE-2023-38039 CVE-2023-38546 CVE-2023-42915 support@hackerone.com support@hackerone.com CVE-2023-38545 CVE-2023-38039 CVE-2023-38546 CVE-2023-38545 CVE-2023-38039 CVE-2023-38546 CVE-2023-38545 CVE-2023-38039 CVE-2023-38546

Affected SoftwareAffected VersionHow to fix
Microsoft Windows 11=21H2
Microsoft Windows 11=22H2
Microsoft Windows 11=21H2
Microsoft Windows Server 2019
Microsoft Windows 11=22H2
Microsoft Windows 11=23H2
Microsoft CBL Mariner 2.0 x64
Microsoft Windows 11=23H2
Microsoft Windows Server 2019
Microsoft CBL Mariner 2.0 ARM
Haxx Curl>=7.84.0<8.3.0
Fedoraproject Fedora=38
Microsoft Windows Server 2022
Microsoft Windows Server 2022
Microsoft Windows 10=21H2
Microsoft Windows 10=22H2
Microsoft Windows 10=21H2
Microsoft Windows 10=21H2
Microsoft Windows 10=22H2
Microsoft Windows 10=1809
Microsoft Windows 10=22H2
Microsoft Windows 10=1809
Microsoft Windows 10=1809
Microsoft Windows Server 2019
Microsoft Windows Server 2019
Microsoft Windows 11=22H2
Microsoft Windows 11=21H2
Microsoft Windows 11=22H2
Microsoft Windows 10=21H2
Microsoft Windows Server 2022
Microsoft Windows 10=21H2
Microsoft Windows 10=22H2
Microsoft Windows 10=1809
Microsoft Windows 10=1809
Microsoft Windows 10=22H2
Microsoft Windows 10=21H2
Microsoft Windows 11=21H2
Microsoft Windows 10=22H2
Microsoft Windows 10=1809
Microsoft Windows 11=23H2
Microsoft Windows Server 2022
Microsoft Windows 11=23H2
redhat/libcurl<8.3.0
8.3.0
Apple iOS<16.7.5
16.7.5
Apple iPadOS<16.7.5
16.7.5
IBM Secure Proxy<=6.0.3
IBM Secure Proxy<=6.1.0
Apple macOS Sonoma<14.2
14.2
Apple macOS Ventura<13.6.4
13.6.4
Apple macOS Monterey<12.7.3
12.7.3
Fedoraproject Fedora=37
Fedoraproject Fedora=39
Microsoft Windows 10 1809<10.0.17763.5122
Microsoft Windows 10 21h2<10.0.19044.3693
Microsoft Windows 10 22h2<10.0.19045.3693
Microsoft Windows 11 21h2<10.0.22000.2600
Microsoft Windows 11 22h2<10.0.22621.2715
Microsoft Windows 11 23h2<10.0.22631.2715
Microsoft Windows Server 2019<10.0.17763.5122
Microsoft Windows Server 2022<10.0.20348.2113
ubuntu/curl<7.88.1-8ubuntu2.2
7.88.1-8ubuntu2.2
ubuntu/curl<8.2.1-1ubuntu3
8.2.1-1ubuntu3
ubuntu/curl<8.2.1-1ubuntu3
8.2.1-1ubuntu3
debian/curl
7.64.0-4+deb10u2
7.64.0-4+deb10u9
7.74.0-1.3+deb11u11
7.88.1-10+deb12u5
8.7.1-5

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is CVE-2023-38039?

    CVE-2023-38039 is a vulnerability in the curl library where HTTP headers can consume all memory.

  • How does CVE-2023-38039 affect curl?

    CVE-2023-38039 affects curl by allowing a malicious server to send an endless series of headers, consuming all available memory.

  • What is the severity of CVE-2023-38039?

    CVE-2023-38039 has a severity rating of high (7.5).

  • How can I fix CVE-2023-38039 on Ubuntu?

    To fix CVE-2023-38039 on Ubuntu, update the 'curl' package to version 7.88.1-8ubuntu2.2 or later.

  • How can I fix CVE-2023-38039 on Debian?

    To fix CVE-2023-38039 on Debian, update the 'curl' package to version 7.88.1-10 or later.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203