When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API.
However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | Aug 22, 2024 | Sep 15, 2023 |
| Amazon Linux Ami 2 | — | Upgrade libcurl-develUpgrade curl-debuginfoUpgrade curlUpgrade libcurl | Oct 6, 2023 | Sep 15, 2023 |
| Amazon_linux_2023 | — | Upgrade curl-minimalUpgrade libcurl-debuginfoUpgrade libcurlUpgrade curlUpgrade libcurl-minimalUpgrade curl-debuginfoUpgrade libcurl-minimal-debuginfoUpgrade curl-debugsourceUpgrade libcurl-develUpgrade curl-minimal-debuginfo | Feb 17, 2025 | Sep 13, 2023 |
| Apple Osx Accessibility | — | — | Oct 14, 2024 | Sep 15, 2023 |
| Apple Osx Accounts | — | — | Oct 14, 2024 | Sep 15, 2023 |
| Apple Osx Appleevents | — | — | Oct 14, 2024 | Sep 15, 2023 |
| Apple Osx Applegraphicscontrol | — | — | Oct 14, 2024 | Sep 15, 2023 |
| Apple Osx Appleva | — | — | Oct 14, 2024 | Sep 15, 2023 |
| Apple Osx Archiveutility | — | — | Oct 14, 2024 | Sep 15, 2023 |
| Apple Osx Assets | — | — | Oct 14, 2024 | Sep 15, 2023 |
| Apple Osx Avevideoencoder | — | — | Oct 14, 2024 | Sep 15, 2023 |
| Apple Osx Bluetooth | — | — | Oct 14, 2024 | Sep 15, 2023 |
| Apple Osx Coremediaplayback | — | — | Oct 14, 2024 | Sep 15, 2023 |
| Apple Osx Coreservices | — | — | Oct 14, 2024 | Sep 15, 2023 |
| Apple Osx Curl | — | Upgrade macOS to the latest version | Jan 23, 2024 | Jan 22, 2024 |
| Debian | — | Upgrade curl | Jul 30, 2024 | Sep 15, 2023 |
| Freebsd | — | Upgrade curl | Dec 10, 2025 | Sep 13, 2023 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Oct 12, 2023 | Sep 15, 2023 |
| Msft | — | 2023-11 Cumulative Update for Microsoft Windows Server 2022, version 22H2 (KB5032198)2023-11 Cumulative Update for Microsoft Windows 10, version 1809 (KB5032196)2023-11 Cumulative Update for Microsoft Windows 10, version 22H2 (KB5032189)2023-11 Cumulative Update for Microsoft Windows 11, version 22H2 (KB5032190)2023-11 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB5032196)2023-11 Cumulative Update for Microsoft Windows 11, version 23H2 (KB5032190)2023-11 Cumulative Update for Microsoft Windows Server 2022, version 21H2 (KB5032198)2023-11 Cumulative Update for Microsoft Windows 10, version 21H2 (KB5032189)2023-11 Cumulative Update for Microsoft Windows 11, version 21H2 (KB5032192) | Nov 14, 2023 | Oct 19, 2023 |
| Oracle Missing Cpu Oct 2023 | — | Apply the October 2023 Critical Patch Update (CPU) for Oracle Database | Oct 18, 2023 | Sep 15, 2023 |
| Suse | — | Upgrade libcurl-devel-32bitUpgrade libcurl4-32bitUpgrade libcurl-develUpgrade libcurl4Upgrade curl | Sep 20, 2023 | Sep 15, 2023 |
| Ubuntu | — | Upgrade libcurl4Upgrade libcurl3-gnutlsUpgrade libcurl3-nssUpgrade curl | Sep 18, 2023 | Sep 13, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 15, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub