CVE-2023-38039 Denial of service in curl
A malicious server can cause curl to exhaust heap memory by sending endless headers, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-38039?
CVE-2023-38039 is a high-severity denial of service vulnerability in Fedoraproject Fedora, published on 15 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API.
However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.
Weakness: CWE-770
Which versions are affected by CVE-2023-38039?
It affects 10 products.
Linux distribution packages (10)
curl SUSE:Linux Enterprise Micro 5.3 | All versions | 8.0.1-150400.5.29.1 |
curl SUSE:Linux Enterprise Micro 5.4 | All versions | 8.0.1-150400.5.29.1 |
curl SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 8.0.1-150400.5.29.1 |
curl SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 8.0.1-150400.5.29.1 |
curl SUSE:Linux Enterprise Server 12 SP5 | All versions | 8.0.1-11.71.1 |
curl SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 8.0.1-11.71.1 |
curl SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 8.0.1-11.71.1 |
curl openSUSE:Leap 15.4 | All versions | 8.0.1-150400.5.29.1 |
curl openSUSE:Leap 15.5 | All versions | 8.0.1-150400.5.29.1 |
curl openSUSE:Tumbleweed | All versions | 8.3.0-1.1 |
Products include Fedoraproject Fedora, Haxx Curl, Microsoft Windows 10 1809, Microsoft Windows 10 21h2, Microsoft Windows 10 22h2, Microsoft Windows 11 21h2 and 4 more.
How do I fix CVE-2023-38039?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-38039 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-38039 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2023-38039, AZL-28833, AZL-29698, AZL-38341, BELL-CVE-2023-38039, CLEANSTART-2026-UC65166 and 9 more.