Security Digest · Vulnerability record
CVE-2023-38546: curl curl vulnerability
This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.
EPSS 6.0% · p93 Most can relax
Should you act?
Normal patch cycle
No exploitation signal; fix it in your next routine update if you are affected. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.
- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 6.0%, percentile 93: FIRST’s model estimates a 6.0% chance of exploitation activity in the next 30 days, higher than 93% of all scored CVEs (elevated). EPSS is a probability, not a verdict.
- Editorial verdict: Most can relax. curl SOCKS5 Heap Overflow: Hyped, but Narrow in Practice — Pre-announced as the worst curl flaw in a long time, the bug only bites when libcurl uses a SOCKS5 proxy with remote name resolution and an attacker can supply a very long hostname; take 8.4.0 or later in normal patching, and hurry only if that proxy setup applies to you.
What it is
This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called curleasyduphandle. If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as none (using the four ASCII letters, no quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named none - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.
Product: curl curl · Assigned by: hackerone · Published: 2023-10-18
Affected and fixed versions
| Vendor | Product | Affected versions (per CVE record) |
|---|---|---|
| curl | curl | 8.4.0 < 8.4.0 |
Severity scores
No CVSS score has been published for this CVE yet.
CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.
Exploitation and urgency
- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none, automatable no, technical impact partial.
- FIRST EPSS (model of 2026-10-21): 5.96% probability of exploitation activity in the next 30 days; percentile 93.
Timeline
- — erroneo.us brief: curl SOCKS5 Heap Overflow: Hyped, but Narrow in Practice
- — CVE record published by hackerone
- — CVE record last updated
Sources and references
Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.
Vulnerability records
- CVE.org record CVE-2023-38546 cve.org
- NVD entry CVE-2023-38546 nvd.nist.gov
Other references from the CVE record and advisory
- curl.se curl.se
- lists.fedoraproject.org lists.fedoraproject.org
- support.apple.com support.apple.com
- support.apple.com support.apple.com
- support.apple.com support.apple.com
- support.apple.com support.apple.com
- seclists.org seclists.org
- seclists.org seclists.org
- seclists.org seclists.org
- forum.vmssoftware.com forum.vmssoftware.com
- lists.debian.org lists.debian.org
- cert-portal.siemens.com cert-portal.siemens.com
- cert-portal.siemens.com cert-portal.siemens.com
- cert-portal.siemens.com cert-portal.siemens.com
- cert-portal.siemens.com cert-portal.siemens.com