CVE-2023-38546 Information disclosure in curl

Low 3.7 Published 18 Oct 2023 Updated 14 Oct 2026

An attacker can force libcurl to load cookies from a file named 'none' if specific conditions are met, potentially exposing sensitive cookie data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-38546?

CVE-2023-38546 is a low-severity vulnerability in Haxx Libcurl, published on 18 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.

libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers.

libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html).

If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters, no quotes).

Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.

Which versions are affected by CVE-2023-38546?

It affects 1 product.

Linux distribution packages (17)

`curl` Red Hat:rhel_eus:8.8::baseos	All versions	`0:7.61.1-30.el8_8.6`
`curl-debuginfo` Red Hat:rhel_eus:8.8::baseos	All versions	`0:7.61.1-30.el8_8.6`
`curl-debugsource` Red Hat:rhel_eus:8.8::baseos	All versions	`0:7.61.1-30.el8_8.6`
`curl-minimal-debuginfo` Red Hat:rhel_eus:8.8::baseos	All versions	`0:7.61.1-30.el8_8.6`
`libcurl` Red Hat:rhel_eus:8.8::baseos	All versions	`0:7.61.1-30.el8_8.6`
`libcurl-debuginfo` Red Hat:rhel_eus:8.8::baseos	All versions	`0:7.61.1-30.el8_8.6`
`libcurl-devel` Red Hat:rhel_eus:8.8::baseos	All versions	`0:7.61.1-30.el8_8.6`
`libcurl-minimal` Red Hat:rhel_eus:8.8::baseos	All versions	`0:7.61.1-30.el8_8.6`
`libcurl-minimal-debuginfo` Red Hat:rhel_eus:8.8::baseos	All versions	`0:7.61.1-30.el8_8.6`
`puppet-agent` Red Hat:rhel_satellite_client:6::el6	All versions	`0:7.28.0-1.el6sat`
`puppet-agent` Red Hat:rhel_satellite_client:6::el7	All versions	`0:7.28.0-1.el7sat`
`puppet-agent` Red Hat:rhel_satellite_client:6::el8	All versions	`0:7.28.0-1.el8sat`
`puppet-agent` Red Hat:rhel_satellite_client:6::el9	All versions	`0:7.28.0-1.el9sat`
`curl` SUSE:Linux Enterprise Micro 5.1	All versions	`7.66.0-150200.4.60.1`
`curl` SUSE:Linux Enterprise Micro 5.2	All versions	`7.66.0-150200.4.60.1`
`curl` SUSE:Manager Proxy 4.2	All versions	`7.66.0-150200.4.60.1`
`curl` SUSE:Manager Server 4.2	All versions	`7.66.0-150200.4.60.1`

Products include Haxx Libcurl.

How do I fix CVE-2023-38546?

Upgrade to a fixed version.

Is CVE-2023-38546 being exploited?

There is no known exploitation of CVE-2023-38546 in the wild and no public exploit code.

All Haxx Libcurl vulnerabilities

Sources

Also known as ALPINE-CVE-2023-38546, AZL-31289, AZL-31502, AZL-34610, AZL-38099, BELL-CVE-2023-38546 and 17 more.