CVE-2023-23916 Denial of service in https://github.com/curl/curl
A malicious server can cause curl to exhaust memory via excessive HTTP compression headers, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-23916?
CVE-2023-23916 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 23 Feb 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.
Weakness: CWE-770
Which versions are affected by CVE-2023-23916?
It affects 9 products.
Linux distribution packages (40)
curl AlmaLinux:8 | All versions | 7.61.1-25.el8_7.3 |
libcurl AlmaLinux:8 | All versions | 7.61.1-25.el8_7.3 |
libcurl-devel AlmaLinux:8 | All versions | 7.61.1-25.el8_7.3 |
libcurl-minimal AlmaLinux:8 | All versions | 7.61.1-25.el8_7.3 |
curl AlmaLinux:9 | All versions | 7.76.1-19.el9_1.2 |
curl-minimal AlmaLinux:9 | All versions | 7.76.1-19.el9_1.2 |
libcurl AlmaLinux:9 | All versions | 7.76.1-19.el9_1.2 |
libcurl-devel AlmaLinux:9 | All versions | 7.76.1-19.el9_1.2 |
libcurl-minimal AlmaLinux:9 | All versions | 7.76.1-19.el9_1.2 |
curl Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-25.el8_7.3 |
curl-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-25.el8_7.3 |
curl-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-25.el8_7.3 |
curl-minimal-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-25.el8_7.3 |
libcurl Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-25.el8_7.3 |
libcurl-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-25.el8_7.3 |
libcurl-devel Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-25.el8_7.3 |
libcurl-minimal Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-25.el8_7.3 |
libcurl-minimal-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-25.el8_7.3 |
curl-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:7.76.1-19.el9_1.2 |
curl-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:7.76.1-19.el9_1.2 |
curl-minimal-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:7.76.1-19.el9_1.2 |
libcurl-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:7.76.1-19.el9_1.2 |
libcurl-devel Red Hat:enterprise_linux:9::appstream | All versions | 0:7.76.1-19.el9_1.2 |
libcurl-minimal-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:7.76.1-19.el9_1.2 |
curl Red Hat:enterprise_linux:9::baseos | All versions | 0:7.76.1-19.el9_1.2 |
curl-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:7.76.1-19.el9_1.2 |
curl-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 0:7.76.1-19.el9_1.2 |
curl-minimal Red Hat:enterprise_linux:9::baseos | All versions | 0:7.76.1-19.el9_1.2 |
curl-minimal-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:7.76.1-19.el9_1.2 |
libcurl Red Hat:enterprise_linux:9::baseos | All versions | 0:7.76.1-19.el9_1.2 |
libcurl-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:7.76.1-19.el9_1.2 |
libcurl-minimal Red Hat:enterprise_linux:9::baseos | All versions | 0:7.76.1-19.el9_1.2 |
libcurl-minimal-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:7.76.1-19.el9_1.2 |
curl Red Hat:rhel_eus:8.6::baseos | All versions | 0:7.61.1-22.el8_6.6 |
curl-debuginfo Red Hat:rhel_eus:8.6::baseos | All versions | 0:7.61.1-22.el8_6.6 |
curl-debugsource Red Hat:rhel_eus:8.6::baseos | All versions | 0:7.61.1-22.el8_6.6 |
curl-minimal-debuginfo Red Hat:rhel_eus:8.6::baseos | All versions | 0:7.61.1-22.el8_6.6 |
libcurl Red Hat:rhel_eus:8.6::baseos | All versions | 0:7.61.1-22.el8_6.6 |
libcurl-debuginfo Red Hat:rhel_eus:8.6::baseos | All versions | 0:7.61.1-22.el8_6.6 |
libcurl-devel Red Hat:rhel_eus:8.6::baseos | All versions | 0:7.61.1-22.el8_6.6 |
Products include Debian Debian Linux, Fedoraproject Fedora, Haxx Curl, Netapp Clustered Data Ontap, Netapp H300s Firmware, Netapp H410s Firmware and 3 more.
How do I fix CVE-2023-23916?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-23916 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-23916 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2023-23916, ALSA-2023:1140, ALSA-2023:1701, AZL-13651, AZL-13653, AZL-13657 and 21 more.