CVE-2016-8623 Use after free in curl

Low 3.3 Published 1 Aug 2018 Updated 16 Apr 2026

A use-after-free flaw in curl's cookie handling allows attackers to disclose sensitive information via concurrent thread access.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2016-8623?

CVE-2016-8623 is a low-severity use after free vulnerability in Haxx Curl, published on 1 Aug 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure.

Weakness: CWE-416

Which versions are affected by CVE-2016-8623?

It affects 1 product.

Products include Haxx Curl.

How do I fix CVE-2016-8623?

Upgrade to a fixed version.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2016-8623 being exploited?

There is no known exploitation of CVE-2016-8623 in the wild and no public exploit code.

All Haxx Curl vulnerabilities

Sources

Also known as ALPINE-CVE-2016-8623, CLEANSTART-2026-HY33416, CURL-CVE-2016-8623, DEBIAN-CVE-2016-8623, GHSA-jfjh-88vc-36cr, UBUNTU-CVE-2016-8623.