This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.
When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes.
If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there.
The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libcurl-minimalUpgrade libcurl-develUpgrade libcurlUpgrade curl-minimalUpgrade curl | Oct 18, 2023 | Oct 17, 2023 |
| Alpine Linux | — | Upgrade curl | Aug 22, 2024 | Oct 18, 2023 |
| Amazon Linux Ami 2 | — | Upgrade curl-debuginfoUpgrade libcurlUpgrade libcurl-develUpgrade curl | Oct 12, 2023 | Oct 12, 2023 |
| Amazon_linux_2023 | — | Upgrade libcurl-debuginfoUpgrade libcurl-develUpgrade libcurlUpgrade curl-debuginfoUpgrade libcurl-minimal-debuginfoUpgrade libcurl-minimalUpgrade curl-minimal-debuginfoUpgrade curl-debugsourceUpgrade curl-minimalUpgrade curl | Feb 17, 2025 | Oct 11, 2023 |
| Apple Osx Accessibility | — | — | Oct 14, 2024 | Oct 18, 2023 |
| Apple Osx Accounts | — | — | Oct 14, 2024 | Oct 18, 2023 |
| Apple Osx Appleevents | — | — | Oct 14, 2024 | Oct 18, 2023 |
| Apple Osx Applegraphicscontrol | — | — | Oct 14, 2024 | Oct 18, 2023 |
| Apple Osx Appleva | — | — | Oct 14, 2024 | Oct 18, 2023 |
| Apple Osx Archiveutility | — | — | Oct 14, 2024 | Oct 18, 2023 |
| Apple Osx Assets | — | — | Oct 14, 2024 | Oct 18, 2023 |
| Apple Osx Avevideoencoder | — | — | Oct 14, 2024 | Oct 18, 2023 |
| Apple Osx Bluetooth | — | — | Oct 14, 2024 | Oct 18, 2023 |
| Apple Osx Coremediaplayback | — | — | Oct 14, 2024 | Oct 18, 2023 |
| Apple Osx Coreservices | — | — | Oct 14, 2024 | Oct 18, 2023 |
| Apple Osx Curl | — | Upgrade macOS to the latest version | Jan 23, 2024 | Jan 22, 2024 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 18, 2023 |
| Centos_linux | — | Upgrade rubygem-foreman_scap_clientUpgrade puppet-agent | Nov 1, 2023 | Oct 18, 2023 |
| Debian | — | Upgrade curl | Oct 12, 2023 | Oct 12, 2023 |
| Fortinet Fortiproxy | — | Upgrade to the latest version of FortiProxy | Sep 30, 2026 | Nov 7, 2023 |
| Fortios | — | Upgrade to the latest version of FortiOS | Jun 23, 2026 | Nov 14, 2023 |
| Freebsd | — | Upgrade mysql-connector-odbcUpgrade cmake-coreUpgrade mysql-connector-c++Upgrade mysql57-serverUpgrade mysql80-serverUpgrade curlUpgrade mysql-connector-j | Oct 24, 2023 | Oct 23, 2023 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Oct 12, 2023 | Oct 11, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libcurlUpgrade curl | Jan 10, 2024 | Oct 18, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade curlUpgrade libcurl | Jan 10, 2024 | Oct 18, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libcurlUpgrade curl | Jan 10, 2024 | Oct 18, 2023 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory3 | Dec 19, 2023 | Oct 18, 2023 |
| Microsoft Office | — | Upgrade to the latest version of Microsoft Office | Jul 9, 2024 | Oct 18, 2023 |
| Msft | — | 2023-11 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB5032196)2023-11 Cumulative Update for Microsoft Windows 11, version 23H2 (KB5032190)2023-11 Cumulative Update for Microsoft Windows 11, version 22H2 (KB5032190)2023-11 Cumulative Update for Microsoft Windows Server 2022, version 21H2 (KB5032198)2023-11 Cumulative Update for Microsoft Windows Server 2022, version 22H2 (KB5032198)2023-11 Cumulative Update for Microsoft Windows 10, version 22H2 (KB5032189)2023-11 Cumulative Update for Microsoft Windows 11, version 21H2 (KB5032192)2023-11 Cumulative Update for Microsoft Windows 10, version 21H2 (KB5032189)2023-11 Cumulative Update for Microsoft Windows 10, version 1809 (KB5032196) | Nov 14, 2023 | Oct 19, 2023 |
| Oracle Missing Cpu Jan 2024 | — | Apply the January 2024 Critical Patch Update (CPU) for Oracle Database | Feb 7, 2024 | Oct 18, 2023 |
| Oracle Mysql | — | Upgrade to MySQL version 8.0.35Upgrade to MySQL version 5.7.44Upgrade to MySQL version 8.2.0 | Jun 15, 2026 | Oct 18, 2023 |
| Oracle_linux | — | Upgrade curl-minimalUpgrade libcurlUpgrade libcurl-minimalUpgrade libcurl-develUpgrade curl | Oct 19, 2023 | Oct 11, 2023 |
| Redhat_linux | — | Upgrade libcurl-minimalUpgrade libcurl-minimal-debuginfoUpgrade curl-minimal-debuginfoUpgrade libcurl-develUpgrade curl-debugsourceUpgrade curlUpgrade libcurl-debuginfoUpgrade curl-debuginfoUpgrade curl-minimalUpgrade libcurl | Nov 1, 2023 | Oct 18, 2023 |
| Rocky_linux | — | — | Aug 15, 2024 | Oct 18, 2023 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.2.1Upgrade Splunk Enterprise to version 9.0.9Upgrade Splunk Enterprise to version 9.1.4 | Jul 30, 2026 | Oct 18, 2023 |
| Suse | — | Upgrade curlUpgrade libcurl4-32bitUpgrade libcurl-develUpgrade libcurl4Upgrade libcurl-devel-32bit | Oct 12, 2023 | Oct 11, 2023 |
| Ubuntu | — | Upgrade libcurl3-gnutlsUpgrade libcurl3-nssUpgrade curlUpgrade libcurl4 | Oct 12, 2023 | Oct 11, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 18, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub