CVE-2023-23915 Security feature bypass in https://github.com/curl/curl

What is CVE-2023-23915?

CVE-2023-23915 is a medium-severity vulnerability in Haxx Curl, published on 23 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS.

Weakness: CWE-319

Which versions are affected by CVE-2023-23915?

It affects 8 products.

Products include Haxx Curl, Netapp Active Iq Unified Manager, Netapp Clustered Data Ontap, Netapp H300s Firmware, Netapp H410s Firmware, Netapp H500s Firmware and 2 more.

How do I fix CVE-2023-23915?

Upgrade to a fixed version.

Is CVE-2023-23915 being exploited?

There is no known exploitation of CVE-2023-23915 in the wild and no public exploit code.

Other vulnerabilities in Haxx Curl

• CVE-2026-19931 Negotiate ambient user conn reuse Critical 9.8
• CVE-2026-10536 HTTP/2 stream-dependency tree UAF Critical 9.8
• CVE-2026-11856 cross-origin Digest auth state leak Critical 9.8
• CVE-2026-8925 SASL double-free Critical 9.8
• CVE-2026-9079 stale proxy password leak Critical 9.8

All Haxx Curl vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2023-23915, AZL-13649, AZL-13652, AZL-13655, AZL-13660, AZL-34601 and 9 more.