curl SOCKS5 Heap Overflow: Hyped, but Narrow in Practice

What to do

1. Check versions with `curl -V` and your language bindings (e.g. `python3 -c "import pycurl; print(pycurl.version)"`).
2. Upgrade curl/libcurl to 8.4.0 or later, or apply your distribution's backported package.
3. Search configs and environment for socks5h:// proxies, CURLPROXY_SOCKS5_HOSTNAME and --socks5-hostname.
4. Where a vulnerable build must keep a SOCKS proxy, avoid remote-resolve mode or set CURLOPT_BUFFERSIZE to at least 65541.
5. Rebuild containers and static binaries that bundle libcurl, since OS updates do not reach them.

How to check if you are affected or compromised

• Run `curl -V` and inventory statically linked or bundled copies of libcurl (for example in container images via an SBOM scan).
• Grep application configs and environment for `socks5h://`, `ALL_PROXY` or `CURLPROXY_SOCKS5_HOSTNAME`.
• Look for crashes in processes that use libcurl through a SOCKS proxy, especially after following redirects to unusual hosts.

What happened#

On October 4, 2023, curl maintainer Daniel Stenberg pre-announced that curl 8.4.0 would ship on October 11 with fixes for one HIGH and one LOW severity flaw, calling the high one "probably the worst curl security flaw in a long time." With curl embedded nearly everywhere, the week of speculation was intense. On October 11 the advisory for CVE-2023-38545 landed: a heap buffer overflow in libcurl's SOCKS5 proxy handshake, affecting 7.69.0 through 8.3.0 and fixed in 8.4.0. Red Hat's public patch commit exposed the fix a few hours early.

The mechanics, from the advisory and Stenberg's write-up: when libcurl asks a SOCKS5 proxy to resolve a hostname, the name can be at most 255 bytes. Longer names should make curl resolve locally instead. A 2020 rewrite into a non-blocking state machine meant that, during a slow handshake, the flag that recorded "resolve locally" was reset on the next call, so curl copied the too-long hostname into a buffer meant for an address. The bug shipped in 7.69.0 and went unnoticed for 1,315 days. Jay Satiro reported and fixed it.

The companion CVE-2023-38546 is low severity: a program using curl_easy_duphandle() could load cookies from a file literally named none in its working directory. It is not reachable through the curl tool.

Who is affected#

Every precondition must hold:

• libcurl 7.69.0 to 8.3.0.
• A SOCKS5 proxy in remote-resolve mode: CURLPROXY_SOCKS5_HOSTNAME, a socks5h:// proxy URL or environment variable, or --socks5-hostname.
• A hostname longer than 255 bytes, which in practice means an attacker controls the URL or a redirect target.
• A slow enough handshake (normal latency can suffice) and a download buffer smaller than the hostname. libcurl's default buffer is 16 kB, so libcurl apps qualify unless they set CURLOPT_BUFFERSIZE to 65541 or more. The curl tool uses about 100 kB and is only vulnerable with --limit-rate below 65541 bytes per second.

Do you really need to act?#

For most people, no more than routine patching. NVD scores it 9.8, but that number ignores the proxy precondition; curl's own rating is High. Stenberg noted the bug "pretty much requires a malicious actor" to feed in an extremely long hostname, and the allowed hostname bytes are restricted. watchTowr built a proof of concept that crashed curl 7.74.0 through corrupted error handling, warned that some 7.x builds are more exposed than 8.x, and said it knew of no trivially exploitable enterprise software. No in-the-wild exploitation has been reported, and the CVE is not in the CISA KEV catalog as of this writing.

The group that should move faster: crawlers, scrapers, privacy tools and services that route libcurl traffic through Tor or other socks5h:// proxies while following untrusted URLs.

What to do now#

1. Check versions: curl -V, plus bindings such as pycurl or PHP's curl extension.
2. Upgrade to 8.4.0 or later, or your distribution's backported package.
3. Search configs and environment for socks5h:// and CURLPROXY_SOCKS5_HOSTNAME.
4. If a vulnerable build must keep using SOCKS, avoid remote-resolve mode or set CURLOPT_BUFFERSIZE to at least 65541.
5. Rebuild containers and static binaries that bundle their own libcurl.

How to tell if you were hit#

There are no public indicators of exploitation. Practical checks: inventory libcurl copies (system packages, container images, vendored builds), confirm whether any use a remote-resolve SOCKS5 proxy, and review crash logs for libcurl-based processes that follow redirects through such a proxy.

Timeline#

• Feb 14, 2020 — Code introducing the bug lands; first shipped in 7.69.0.
• Oct 4, 2023 — curl pre-announces a HIGH severity fix.
• Oct 11, 2023 — curl 8.4.0 and advisories for CVE-2023-38545 and CVE-2023-38546 published.
• Oct 18, 2023 — CVE records published in NVD.
• Oct 21, 2026 — Still not in CISA KEV; no known in-the-wild exploitation.

Vulnerability records

• CVE-2023-38545 · This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.
• CVE-2023-38546 · This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. curl — CVE-2023-38545: SOCKS5 heap buffer overflow curl.se
2. curl — CVE-2023-38546: cookie injection with none file curl.se
3. NVD — CVE-2023-38545 nvd.nist.gov
4. Daniel Stenberg — How I made a heap overflow in curl daniel.haxx.se
5. curl GitHub Discussions — curl 8.4.0 pre-announcement (#12026) github.com
6. watchTowr Labs — The Sky Has Not Yet Fallen: Curl (CVE-2023-38545) labs.watchtowr.com
7. CISA — Known Exploited Vulnerabilities Catalog cisa.gov