CVE-2023-27535 Auth bypass in https://github.com/curl/curl

Q: Is CVE-2023-27535 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-27535 exists.

Medium 5.9 Published 30 Mar 2023 Updated 14 Oct 2026

An authentication bypass in libcurl's FTP connection reuse allows attackers to use wrong credentials, potentially accessing sensitive information.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-27535?

CVE-2023-27535 is a medium-severity authentication bypass vulnerability in Debian Debian Linux, published on 30 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information.

Weakness: CWE-287, CWE-305

Which versions are affected by CVE-2023-27535?

It affects 10 products.

Linux distribution packages (34)

`curl` AlmaLinux:8	All versions	`7.61.1-30.el8_8.2`
`libcurl` AlmaLinux:8	All versions	`7.61.1-30.el8_8.2`
`libcurl-devel` AlmaLinux:8	All versions	`7.61.1-30.el8_8.2`
`libcurl-minimal` AlmaLinux:8	All versions	`7.61.1-30.el8_8.2`
`curl` AlmaLinux:9	All versions	`7.76.1-23.el9_2.1`
`curl-minimal` AlmaLinux:9	All versions	`7.76.1-23.el9_2.1`
`libcurl` AlmaLinux:9	All versions	`7.76.1-23.el9_2.1`
`libcurl-devel` AlmaLinux:9	All versions	`7.76.1-23.el9_2.1`
`libcurl-minimal` AlmaLinux:9	All versions	`7.76.1-23.el9_2.1`
`curl` Red Hat:enterprise_linux:8::baseos	All versions	`0:7.61.1-30.el8_8.2`
`curl-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:7.61.1-30.el8_8.2`
`curl-debugsource` Red Hat:enterprise_linux:8::baseos	All versions	`0:7.61.1-30.el8_8.2`
`curl-minimal-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:7.61.1-30.el8_8.2`
`libcurl` Red Hat:enterprise_linux:8::baseos	All versions	`0:7.61.1-30.el8_8.2`
`libcurl-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:7.61.1-30.el8_8.2`
`libcurl-devel` Red Hat:enterprise_linux:8::baseos	All versions	`0:7.61.1-30.el8_8.2`
`libcurl-minimal` Red Hat:enterprise_linux:8::baseos	All versions	`0:7.61.1-30.el8_8.2`
`libcurl-minimal-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:7.61.1-30.el8_8.2`
`curl-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:7.76.1-23.el9_2.1`
`curl-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`0:7.76.1-23.el9_2.1`
`curl-minimal-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:7.76.1-23.el9_2.1`
`libcurl-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:7.76.1-23.el9_2.1`
`libcurl-devel` Red Hat:enterprise_linux:9::appstream	All versions	`0:7.76.1-23.el9_2.1`
`libcurl-minimal-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:7.76.1-23.el9_2.1`
`curl` Red Hat:enterprise_linux:9::baseos	All versions	`0:7.76.1-23.el9_2.1`
`curl-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:7.76.1-23.el9_2.1`
`curl-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`0:7.76.1-23.el9_2.1`
`curl-minimal` Red Hat:enterprise_linux:9::baseos	All versions	`0:7.76.1-23.el9_2.1`
`curl-minimal-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:7.76.1-23.el9_2.1`
`libcurl` Red Hat:enterprise_linux:9::baseos	All versions	`0:7.76.1-23.el9_2.1`
`libcurl-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:7.76.1-23.el9_2.1`
`libcurl-minimal` Red Hat:enterprise_linux:9::baseos	All versions	`0:7.76.1-23.el9_2.1`
`libcurl-minimal-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:7.76.1-23.el9_2.1`
`curl` Rocky Linux:8	All versions	`0:7.61.1-30.el8_8.2`

Products include Debian Debian Linux, Fedoraproject Fedora, Haxx Libcurl, Netapp Active Iq Unified Manager, Netapp H300s Firmware, Netapp H410s Firmware and 4 more.

How do I fix CVE-2023-27535?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2023-27535 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-27535 exists.

All Debian Debian Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2023-27535, ALSA-2023:2650, ALSA-2023:3106, AZL-25787, AZL-25805, AZL-25811 and 12 more.