Information disclosure in https://github.com/curl/curl
Priority MEDIUM 63CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 12 fixed, 3 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-200.
Summary
An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02211 82nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 9 advisoriesRed Hat: 12 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | https://github.com/curl/curl | Fixed in 8.1.0 | — | No fix listed | CNA |
- https://github.com/curl/curl Vendor— Affected Fixed in 8.1.0 Fixed in — No fix listed CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* | before 8.1.0 | Vulnerable | Haxx |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* | 11.0 to before 11.7.9; 12.0 to before 12.6.8; 13.0 to before 13.5 | Vulnerable | Apple |
| cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:ontap_antivirus_connector:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
- cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* Versions before 8.1.0 Vulnerable ·Haxx
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* Versions 11.0 to before 11.7.9; 12.0 to before 12.6.8; 13.0 to before 13.5 Vulnerable ·Apple
- cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:ontap_antivirus_connector:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Remediation
Red Hat 9 advisories
- RHSA-2024:2092 Released 2024-05-01 · Red Hat rating Moderatesecurity update Logging for Red Hat OpenShift - 5.6.18
- RHOL 5.6 for RHEL 8 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel8-operator, openshift-logging/elasticsearch-operator-bundle +15
- RHSA-2024:2093 Released 2024-05-01 · Red Hat rating Moderatesecurity update Logging for Red Hat OpenShift - 5.7.13
- RHOL 5.7 for RHEL 8 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel8-operator, openshift-logging/elasticsearch-operator-bundle +15
- RHSA-2024:1601 Released 2024-04-02 · Red Hat rating Moderatecurl security and bug fix update
- Red Hat Enterprise Linux BaseOS (v. 8) curl-7.61.1-33.el8_9.5, libcurl-7.61.1-33.el8_9.5, libcurl-devel-7.61.1-33.el8_9.5 +1
Show 6 more Red Hat advisories
- RHSA-2024:0585 Released 2024-01-30 · Red Hat rating Moderatecurl security and bug fix update
- Red Hat Enterprise Linux BaseOS EUS (v.8.8) curl-7.61.1-30.el8_8.9, libcurl-7.61.1-30.el8_8.9, libcurl-devel-7.61.1-30.el8_8.9 +1
- RHSA-2024:0428 Released 2024-01-25 · Red Hat rating Moderatecurl security and bug fix update
- Red Hat Enterprise Linux BaseOS EUS (v.8.6) curl-7.61.1-22.el8_6.12, libcurl-7.61.1-22.el8_6.12, libcurl-devel-7.61.1-22.el8_6.12 +1
- RHSA-2023:5598 Released 2023-10-10 · Red Hat rating Moderatecurl security update
- Red Hat Enterprise Linux AppStream EUS (v.9.0) libcurl-devel-7.76.1-14.el9_0.7
- Red Hat Enterprise Linux BaseOS EUS (v.9.0) curl-7.76.1-14.el9_0.7, curl-minimal-7.76.1-14.el9_0.7, libcurl-7.76.1-14.el9_0.7 +1
- RHSA-2023:4629 Released 2023-08-15 · Red Hat rating ModerateRed Hat JBoss Core Services Apache HTTP Server 2.4.57 security update
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-1.7.0-8.el7jbcs, jbcs-httpd24-apr-devel-1.7.0-8.el7jbcs, jbcs-httpd24-curl-8.2.1-1.el7jbcs +12
- Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-apr-1.7.0-8.el8jbcs, jbcs-httpd24-apr-devel-1.7.0-8.el8jbcs, jbcs-httpd24-curl-8.2.1-1.el8jbcs +12
- RHSA-2023:4628 Released 2023-08-15 · Red Hat rating ModerateRed Hat JBoss Core Services Apache HTTP Server 2.4.57 security update
- Red Hat JBoss Core Services 2.4.57
- RHSA-2023:4354 Released 2023-08-01 · Red Hat rating Moderatecurl security update
- Red Hat Enterprise Linux AppStream (v. 9) libcurl-devel-7.76.1-23.el9_2.2
- Red Hat Enterprise Linux BaseOS (v. 9) curl-7.76.1-23.el9_2.2, curl-minimal-7.76.1-23.el9_2.2, libcurl-7.76.1-23.el9_2.2 +1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
https://github.com/curl/curl — FEDORA-2023-37eac50e9b
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2023-12869 Improper certificate validation in https://github.com/curl/curlPriority MEDIUM 60
- Advisory ·
https://github.com/curl/curl — FEDORA-2023-8ed627bb04
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2023-12869 Improper certificate validation in https://github.com/curl/curlPriority MEDIUM 60
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| .NET Core 3.1 on Red Hat Enterprise Linux | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| RHOL 5.6 for RHEL 8 | Fixed | RHSA-2024:2092 |
| RHOL 5.7 for RHEL 8 | Fixed | RHSA-2024:2093 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:4354 |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Fixed | RHSA-2023:5598 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2024:1601 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2023:4354 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.6) | Fixed | RHSA-2024:0428 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.8) | Fixed | RHSA-2024:0585 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.0) | Fixed | RHSA-2023:5598 |
| Red Hat JBoss Core Services 2.4.57 | Fixed | RHSA-2023:4628 |
| Red Hat JBoss Core Services on RHEL 7 Server | Fixed | RHSA-2023:4629 |
| Red Hat JBoss Core Services on RHEL 8 | Fixed | RHSA-2023:4629 |
Not affected: 2 products
- Red Hat JBoss Core Services on RHEL 7 Server
- Red Hat JBoss Core Services on RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2023-28322
- 2026-10-03 Alias added: GHSA-78jh-p6rf-g59w
- 2026-10-09 Fix available: RHSA-2023:4628 · Red Hat
- 2026-10-31 Fix available: Red Hat JBoss Core Services 2.4.57 · Red Hat
References
Advisory 10
- FEDORA-2023-37eac50e9b
- FEDORA-2023-8ed627bb04
- https://security.netapp.com/advisory/ntap-20230609-0009/
- https://support.apple.com/kb/HT213843
- https://support.apple.com/kb/HT213844
- https://support.apple.com/kb/HT213845
- 20230725 APPLE-SA-2023-07-24-6 macOS Big Sur 11.7.9
- 20230725 APPLE-SA-2023-07-24-5 macOS Monterey 12.6.8
- 20230725 APPLE-SA-2023-07-24-4 macOS Ventura 13.5
- GLSA-202310-12
Sources
- CVE-2023-28322 · CVE Program
- CVE-2023-28322 · NVD
- FIRST EPSS
- GHSA-78jh-p6rf-g59w · GitHub Advisory Database · CC BY 4.0
- CVE-2023-28322 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences