---
title: "CVE-2023-38546: curl curl vulnerability"
url: https://erroneo.us/security/cve/CVE-2023-38546/
description: "CVE-2023-38546 (curl curl): This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of…"
type: vulnerability-record
section: "Security Digest"
date_published: 2023-10-18
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2023-38546"
kev: false
cvss: null
epss: 0.05956
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2023-38546: curl curl vulnerability

**Signal:** Normal patch cycle. No exploitation signal; fix it in your next routine update if you are affected. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 6.0% , percentile 93: FIRST’s model estimates a 6.0% chance of exploitation activity in the next 30 days, higher than 93% of all scored CVEs (elevated). EPSS is a probability, not a verdict.
- Editorial verdict: Most can relax. curl SOCKS5 Heap Overflow: Hyped, but Narrow in Practice — Pre-announced as the worst curl flaw in a long time, the bug only bites when libcurl uses a SOCKS5 proxy with remote name resolution and an attacker can supply a very long hostname; take 8.4.0 or later in normal patching, and hurry only if that proxy setup applies to you.

## What it is

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called curleasyduphandle. If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as none (using the four ASCII letters, no quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named none - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.

## Affected products (CVE record)

- curl curl: 8.4.0 < 8.4.0

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact partial .
- FIRST EPSS (model of 2026-10-21): 5.96% probability of exploitation activity in the next 30 days; percentile 93.

## Sources

- [CVE.org record CVE-2023-38546](https://www.cve.org/CVERecord?id=CVE-2023-38546)
- [NVD entry CVE-2023-38546](https://nvd.nist.gov/vuln/detail/CVE-2023-38546)
- [curl.se](https://curl.se/docs/CVE-2023-38546.html)
- [lists.fedoraproject.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/)
- [support.apple.com](https://support.apple.com/kb/HT214036)
- [support.apple.com](https://support.apple.com/kb/HT214063)
- [support.apple.com](https://support.apple.com/kb/HT214057)
- [support.apple.com](https://support.apple.com/kb/HT214058)
- [seclists.org](http://seclists.org/fulldisclosure/2024/Jan/34)
- [seclists.org](http://seclists.org/fulldisclosure/2024/Jan/37)
- [seclists.org](http://seclists.org/fulldisclosure/2024/Jan/38)
- [forum.vmssoftware.com](https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868)
- [lists.debian.org](https://lists.debian.org/debian-lts-announce/2023/10/msg00016.html)
- [cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-943925.html)
- [cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-832273.html)
- [cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-093430.html)
- [cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-082556.html)

---
Source page: https://erroneo.us/security/cve/CVE-2023-38546/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt