---
title: "curl SOCKS5 Heap Overflow: Hyped, but Narrow in Practice"
url: https://erroneo.us/security/briefs/curl-socks5-heap-overflow-cve-2023-38545/
description: "CVE-2023-38545 overflows libcurl 7.69.0-8.3.0 only via socks5h proxies plus attacker-controlled long hostnames. Upgrade to 8.4.0+; most can relax."
type: security-brief
section: "Security Digest"
date_published: 2023-10-11
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Most can relax"
cves: ["CVE-2023-38545", "CVE-2023-38546"]
severity: "high"
exploited: "public-poc"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# curl SOCKS5 Heap Overflow: Hyped, but Narrow in Practice

**Verdict: Most can relax.** Pre-announced as the worst curl flaw in a long time, the bug only bites when libcurl uses a SOCKS5 proxy with remote name resolution and an attacker can supply a very long hostname; take 8.4.0 or later in normal patching, and hurry only if that proxy setup applies to you.

- **Who must act:** Software that sends libcurl 7.69.0 to 8.3.0 traffic through socks5h:// (remote-resolve) proxies to URLs or redirects an attacker can influence, especially on old 7.x builds.
- **Who can relax:** Anyone who does not use SOCKS5 proxies with hostname resolution, including the curl command-line tool at default settings, which is only vulnerable with --limit-rate below 65541 bytes per second.
- **Affected:** libcurl 7.69.0 through 8.3.0 (CVE-2023-38545); libcurl 7.9.1 through 8.3.0 (CVE-2023-38546, low severity)
- **Fixed:** curl/libcurl 8.4.0; Distribution backports of the upstream patch
- **CVEs:** CVE-2023-38545, CVE-2023-38546
- **CISA KEV:** no · **Exploitation:** Public proof-of-concept

## What to do

1. Check versions with `curl -V` and your language bindings (e.g. `python3 -c "import pycurl; print(pycurl.version)"`).
2. Upgrade curl/libcurl to 8.4.0 or later, or apply your distribution's backported package.
3. Search configs and environment for socks5h:// proxies, CURLPROXY_SOCKS5_HOSTNAME and --socks5-hostname.
4. Where a vulnerable build must keep a SOCKS proxy, avoid remote-resolve mode or set CURLOPT_BUFFERSIZE to at least 65541.
5. Rebuild containers and static binaries that bundle libcurl, since OS updates do not reach them.

### How to check if you are affected

- Run `curl -V` and inventory statically linked or bundled copies of libcurl (for example in container images via an SBOM scan).
- Grep application configs and environment for `socks5h://`, `ALL_PROXY` or `CURLPROXY_SOCKS5_HOSTNAME`.
- Look for crashes in processes that use libcurl through a SOCKS proxy, especially after following redirects to unusual hosts.

## What happened

On October 4, 2023, curl maintainer Daniel Stenberg [pre-announced](https://github.com/curl/curl/discussions/12026) that curl 8.4.0 would ship on October 11 with fixes for one HIGH and one LOW severity flaw, calling the high one "probably the worst curl security flaw in a long time." With curl embedded nearly everywhere, the week of speculation was intense. On October 11 the [advisory for CVE-2023-38545](https://curl.se/docs/CVE-2023-38545.html) landed: a heap buffer overflow in libcurl's SOCKS5 proxy handshake, affecting 7.69.0 through 8.3.0 and fixed in 8.4.0. Red Hat's public patch commit exposed the fix a few hours early.

The mechanics, from the advisory and [Stenberg's write-up](https://daniel.haxx.se/blog/2023/10/11/how-i-made-a-heap-overflow-in-curl/): when libcurl asks a SOCKS5 proxy to resolve a hostname, the name can be at most 255 bytes. Longer names should make curl resolve locally instead. A 2020 rewrite into a non-blocking state machine meant that, during a slow handshake, the flag that recorded "resolve locally" was reset on the next call, so curl copied the too-long hostname into a buffer meant for an address. The bug shipped in 7.69.0 and went unnoticed for 1,315 days. Jay Satiro reported and fixed it.

The companion [CVE-2023-38546](https://curl.se/docs/CVE-2023-38546.html) is low severity: a program using `curl_easy_duphandle()` could load cookies from a file literally named `none` in its working directory. It is not reachable through the curl tool.

## Who is affected

Every precondition must hold:

- libcurl 7.69.0 to 8.3.0.
- A SOCKS5 proxy in remote-resolve mode: `CURLPROXY_SOCKS5_HOSTNAME`, a `socks5h://` proxy URL or environment variable, or `--socks5-hostname`.
- A hostname longer than 255 bytes, which in practice means an attacker controls the URL or a redirect target.
- A slow enough handshake (normal latency can suffice) and a download buffer smaller than the hostname. libcurl's default buffer is 16 kB, so libcurl apps qualify unless they set `CURLOPT_BUFFERSIZE` to 65541 or more. The curl tool uses about 100 kB and is only vulnerable with `--limit-rate` below 65541 bytes per second.

## Do you really need to act?

For most people, no more than routine patching. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-38545) scores it 9.8, but that number ignores the proxy precondition; curl's own rating is High. Stenberg noted the bug "pretty much requires a malicious actor" to feed in an extremely long hostname, and the allowed hostname bytes are restricted. [watchTowr](https://labs.watchtowr.com/curl-cve-2023-38545-its-still-not-the-end-of-the-world/) built a proof of concept that crashed curl 7.74.0 through corrupted error handling, warned that some 7.x builds are more exposed than 8.x, and said it knew of no trivially exploitable enterprise software. No in-the-wild exploitation has been reported, and the CVE is not in the [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) as of this writing.

The group that should move faster: crawlers, scrapers, privacy tools and services that route libcurl traffic through Tor or other `socks5h://` proxies while following untrusted URLs.

## What to do now

1. Check versions: `curl -V`, plus bindings such as pycurl or PHP's curl extension.
2. Upgrade to 8.4.0 or later, or your distribution's backported package.
3. Search configs and environment for `socks5h://` and `CURLPROXY_SOCKS5_HOSTNAME`.
4. If a vulnerable build must keep using SOCKS, avoid remote-resolve mode or set `CURLOPT_BUFFERSIZE` to at least 65541.
5. Rebuild containers and static binaries that bundle their own libcurl.

## How to tell if you were hit

There are no public indicators of exploitation. Practical checks: inventory libcurl copies (system packages, container images, vendored builds), confirm whether any use a remote-resolve SOCKS5 proxy, and review crash logs for libcurl-based processes that follow redirects through such a proxy.

## Timeline

- Feb 14, 2020 — Code introducing the bug lands; first shipped in 7.69.0.
- Oct 4, 2023 — curl pre-announces a HIGH severity fix.
- Oct 11, 2023 — curl 8.4.0 and advisories for CVE-2023-38545 and CVE-2023-38546 published.
- Oct 18, 2023 — CVE records published in NVD.
- Oct 21, 2026 — Still not in CISA KEV; no known in-the-wild exploitation.

## Sources

1. [curl — CVE-2023-38545: SOCKS5 heap buffer overflow](https://curl.se/docs/CVE-2023-38545.html)
2. [curl — CVE-2023-38546: cookie injection with none file](https://curl.se/docs/CVE-2023-38546.html)
3. [NVD — CVE-2023-38545](https://nvd.nist.gov/vuln/detail/CVE-2023-38545)
4. [Daniel Stenberg — How I made a heap overflow in curl](https://daniel.haxx.se/blog/2023/10/11/how-i-made-a-heap-overflow-in-curl/)
5. [curl GitHub Discussions — curl 8.4.0 pre-announcement (#12026)](https://github.com/curl/curl/discussions/12026)
6. [watchTowr Labs — The Sky Has Not Yet Fallen: Curl (CVE-2023-38545)](https://labs.watchtowr.com/curl-cve-2023-38545-its-still-not-the-end-of-the-world/)
7. [CISA — Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

---
Source page: https://erroneo.us/security/briefs/curl-socks5-heap-overflow-cve-2023-38545/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt