CVE-2023-38545
CriticalSummary
CVE-2023-38545 is a vulnerability related to heap buffer overflow during the SOCKS5 proxy handshake in curl. The issue arises when curl passes a hostname that is too long to the proxy, leading to incorrect data copying.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized memory access, threatening the integrity and confidentiality of data in systems using curl.
Recommendation
It is recommended to update curl to the latest version that includes security patches to minimize the risk associated with this vulnerability.
Other vulnerabilities in curl
See all- CVE-2022-27775High
An information disclosure vulnerability exists in curl versions 7.65.0 to 7.82.0 that allows reusing a connection using an IPv6 address with a different zone id.
- CVE-2022-22576High
An improper authentication vulnerability exists in curl versions 7.33.0 to 7.82.0 which might allow reuse of OAUTH2-authenticated connections without properly ensuring that the connection was authenticated with the same credentials. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S), and LDAP(S) (openldap only).
- CVE-2024-9681Medium
When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects applications using HSTS and URLs with the insecure HTTP:// scheme.
- CVE-2024-8096Medium
When curl is told to use the Certificate Status Request TLS extension (OCSP stapling) to verify the server certificate, it might fail to detect some OCSP problems and wrongly consider the response as fine if the returned status reports another error than expected.
- CVE-2024-11053Low
When curl is asked to use a `.netrc` file for credentials and to follow HTTP redirects, it could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests if the netrc file has an entry matching the redirect target hostname.
- CVE-2026-8926Critical
A vulnerability in curl causes it to incorrectly use another user's password from the .netrc file when a URL with a username (without password) is provided, potentially leading to credential confusion.
- CVE-2026-8925Critical
A double-free vulnerability has been found in the curl library's SASL authentication handling. The GSASL context is cleaned up twice without clearing the pointer, causing free() to be called on the same memory region twice.
- CVE-2026-8924Critical
A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.
- CVE-2026-80255Low risk· EPSS 12%
A Set-Cookie header using a tab (ASCII 9) instead of a space (ASCII 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.
- CVE-2026-12064High
A vulnerability in curl causes the tool layer to skip initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS when using a schemeless URL with `--proto-default sftp` (or scp), while libcurl establishes the SFTP/SCP connection. This results in curl connecting to an unverified SSH remote host without error.
Original NVD description (English source)
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with.