Read the docs
TI-2023-09714 Aliases CVE-2023-23916GHSA-v8vq-prc2-j6gx

Resource allocation without limits in https://github.com/curl/curl

Priority MEDIUM 62CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 12 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-770.

Summary

An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01742 77th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 7 advisoriesRed Hat: 12 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—https://github.com/curl/curlFixed in 7.88.0—No fix listedCNA
  • https://github.com/curl/curl Vendor— Affected Fixed in 7.88.0 Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*7.57.0 to before 7.88.0VulnerableHaxx
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
  • cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* Versions 7.57.0 to before 7.88.0 Vulnerable ·Haxx
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*8.2.0 to before 8.2.12; 9.0.0 to before 9.0.6VulnerableSplunk
cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*9.1.0VulnerableSplunk
  • cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* Versions 8.2.0 to before 8.2.12; 9.0.0 to before 9.0.6 Vulnerable ·Splunk
  • cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* Versions 9.1.0 Vulnerable ·Splunk

Remediation

Red Hat 7 advisories

  • RHSA-2023:4139 Released 2023-07-18 · Red Hat rating Moderate
    curl security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) libcurl-devel-7.76.1-14.el9_0.6
    • Red Hat Enterprise Linux BaseOS EUS (v.9.0) curl-7.76.1-14.el9_0.6, curl-minimal-7.76.1-14.el9_0.6, libcurl-7.76.1-14.el9_0.6 +1
  • RHSA-2023:3460 Released 2023-06-06 · Red Hat rating Moderate
    curl security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) curl-7.61.1-18.el8_4.3, libcurl-7.61.1-18.el8_4.3, libcurl-devel-7.61.1-18.el8_4.3 +1
    • Red Hat Enterprise Linux BaseOS E4S (v.8.4) curl-7.61.1-18.el8_4.3, libcurl-7.61.1-18.el8_4.3, libcurl-devel-7.61.1-18.el8_4.3 +1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.4) curl-7.61.1-18.el8_4.3, libcurl-7.61.1-18.el8_4.3, libcurl-devel-7.61.1-18.el8_4.3 +1
  • RHSA-2023:3354 Released 2023-06-05 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP2 security update
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-util-1.6.1-101.el7jbcs, jbcs-httpd24-apr-util-devel-1.6.1-101.el7jbcs, jbcs-httpd24-apr-util-ldap-1.6.1-101.el7jbcs +23
    • Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-apr-util-1.6.1-101.el8jbcs, jbcs-httpd24-apr-util-devel-1.6.1-101.el8jbcs, jbcs-httpd24-apr-util-ldap-1.6.1-101.el8jbcs +23
Show 4 more Red Hat advisories
  • RHSA-2023:3355 Released 2023-06-05 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP2 security update
    • JBCS httpd 2.4.51.sp2
  • RHSA-2023:1842 Released 2023-04-18 · Red Hat rating Moderate
    curl security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.6) curl-7.61.1-22.el8_6.6, libcurl-7.61.1-22.el8_6.6, libcurl-devel-7.61.1-22.el8_6.6 +1
  • RHSA-2023:1701 Released 2023-04-11 · Red Hat rating Moderate
    curl security update
    • Red Hat Enterprise Linux AppStream (v. 9) libcurl-devel-7.76.1-19.el9_1.2
    • Red Hat Enterprise Linux BaseOS (v. 9) curl-7.76.1-19.el9_1.2, curl-minimal-7.76.1-19.el9_1.2, libcurl-7.76.1-19.el9_1.2 +1
  • RHSA-2023:1140 Released 2023-03-07 · Red Hat rating Moderate
    curl security update
    • Red Hat Enterprise Linux BaseOS (v. 8) curl-7.61.1-25.el8_7.3, libcurl-7.61.1-25.el8_7.3, libcurl-devel-7.61.1-25.el8_7.3 +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
.NET Core 3.1 on Red Hat Enterprise LinuxAffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
JBCS httpd 2.4.51.sp2Fixed RHSA-2023:3355
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:1701
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2023:4139
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2023:1140
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2023:1701
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2023:3460
Red Hat Enterprise Linux BaseOS E4S (v.8.4)Fixed RHSA-2023:3460
Red Hat Enterprise Linux BaseOS EUS (v.8.6)Fixed RHSA-2023:1842
Red Hat Enterprise Linux BaseOS EUS (v.9.0)Fixed RHSA-2023:4139
Red Hat Enterprise Linux BaseOS TUS (v.8.4)Fixed RHSA-2023:3460
Red Hat JBoss Core Services on RHEL 7 ServerFixed RHSA-2023:3354
Red Hat JBoss Core Services on RHEL 8Fixed RHSA-2023:3354
Not affected: 3 products
  • Red Hat Enterprise Linux 7
  • Red Hat JBoss Core Services on RHEL 7 Server
  • Red Hat JBoss Core Services on RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-23916
  2. 2026-10-03 Alias added: GHSA-v8vq-prc2-j6gx
  3. 2026-10-09 Fix available: RHSA-2023:3355 · Red Hat
  4. 2026-10-16 Fix available: JBCS httpd 2.4.51.sp2 · Red Hat

References

Exploit 1

Advisory 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences