CVE-2023-38039
Fixed in a distro release EPSS 56%CVSS 7.5
When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.
Products: curl
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.15 | curl | 8.3.0-r0 |
| Alpine 3.16 | curl | 8.3.0-r0 |
| Alpine 3.17 | curl | 8.3.0-r0 |
| Alpine 3.18 | curl | 8.3.0-r0 |
| Alpine 3.19 | curl | 8.3.0-r0 |
| Alpine 3.20 | curl | 8.3.0-r0 |
| Alpine 3.21 | curl | 8.3.0-r0 |
| Alpine 3.22 | curl | 8.3.0-r0 |
| Alpine 3.23 | curl | 8.3.0-r0 |
| Alpine 3.24 | curl | 8.3.0-r0 |
| Chainguard | libcurl4 | no fix |
| Debian 12 | curl | 7.88.1-10+deb12u3 |
| Debian 13 | curl | 8.3.0-1 |
| Debian 14 | curl | 8.3.0-1 |
| Red Hat jboss core services 1 | jbcs-httpd24-curl | 0:8.4.0-2.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl | 0:8.4.0-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl-debuginfo | 0:8.4.0-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl-debuginfo | 0:8.4.0-2.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl | 0:8.4.0-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl | 0:8.4.0-2.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-debuginfo | 0:8.4.0-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-devel | 0:8.4.0-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-devel | 0:8.4.0-2.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_http2 | 0:1.15.19-32.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_http2 | 0:1.15.19-32.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_http2-debuginfo | 0:1.15.19-32.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_http2-debuginfo | 0:1.15.19-32.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk | 0:1.2.49-1.redhat_1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk | 0:1.2.49-1.redhat_1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-ap24 | 0:1.2.49-1.redhat_1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-ap24 | 0:1.2.49-1.redhat_1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-ap24-debuginfo | 0:1.2.49-1.redhat_1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-debuginfo | 0:1.2.49-1.redhat_1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl | 1:1.1.1k-16.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl | 1:1.1.1k-16.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-debuginfo | 1:1.1.1k-16.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-debuginfo | 1:1.1.1k-16.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-devel | 1:1.1.1k-16.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-devel | 1:1.1.1k-16.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-libs | 1:1.1.1k-16.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-libs | 1:1.1.1k-16.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-libs-debuginfo | 1:1.1.1k-16.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-perl | 1:1.1.1k-16.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-perl | 1:1.1.1k-16.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-static | 1:1.1.1k-16.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-static | 1:1.1.1k-16.el7jbcs |
| SUSE Linux Enterprise Micro 5.3 | curl | 8.0.1-150400.5.29.1 |
| SUSE Linux Enterprise Micro 5.4 | curl | 8.0.1-150400.5.29.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | curl | 8.0.1-150400.5.29.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | curl | 8.0.1-150400.5.29.1 |
| SUSE Linux Enterprise Server 12 SP5 | curl | 8.0.1-11.71.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | curl | 8.0.1-11.71.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | curl | 8.0.1-11.71.1 |
| Ubuntu 24.04 LTS | curl | 8.2.1-1ubuntu3 |
| Wolfi | libcurl4 | no fix |
| openSUSE Leap 15.4 | curl | 8.0.1-150400.5.29.1 |
| openSUSE Leap 15.5 | curl | 8.0.1-150400.5.29.1 |
| openSUSE Tumbleweed | curl | 8.3.0-1.1 |