Read the docs
TI-2023-19463 Aliases CVE-2023-38039GHSA-99j9-jf36-9747

Resource allocation without limits in curl

Priority HIGH 72CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-770.

Summary

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.56211 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed curl (curl): 8.3.0, 7.84.0Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
curlcurl8.3.0 to before 8.3.08.3.0, 7.84.0Patch availableCNA
  • curl Vendorcurl Affected 8.3.0 to before 8.3.0 Fixed in 8.3.0, 7.84.0 Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*7.84.0 to before 8.3.0VulnerableHaxx
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*38VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*39VulnerableFedoraproject
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*before 10.0.17763.5122VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*before 10.0.19044.3693VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*before 10.0.19045.3693VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*before 10.0.22000.2600VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*before 10.0.22621.2715VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*before 10.0.22631.2715VulnerableMicrosoft
  • cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* Versions 7.84.0 to before 8.3.0 Vulnerable ·Haxx
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
  • cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:* Versions before 10.0.17763.5122 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* Versions before 10.0.19044.3693 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* Versions before 10.0.19045.3693 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:* Versions before 10.0.22000.2600 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:* Versions before 10.0.22621.2715 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:* Versions before 10.0.22631.2715 Vulnerable ·Microsoft
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*before 10.0.17763.5122VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*before 10.0.20348.2113VulnerableMicrosoft
  • cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* Versions before 10.0.17763.5122 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* Versions before 10.0.20348.2113 Vulnerable ·Microsoft

Remediation

  • Fix · CNA curl (curl) Fixed in 8.3.0, 7.84.0

Red Hat 2 advisories

  • RHSA-2023:7626 Released 2023-12-07 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP2 security update
    • Red Hat JBoss Core Services
  • RHSA-2023:7625 Released 2023-12-07 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP2 security update
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl-8.4.0-2.el7jbcs, jbcs-httpd24-libcurl-8.4.0-2.el7jbcs, jbcs-httpd24-libcurl-devel-8.4.0-2.el7jbcs +8
    • Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-curl-8.4.0-2.el8jbcs, jbcs-httpd24-libcurl-8.4.0-2.el8jbcs, jbcs-httpd24-libcurl-devel-8.4.0-2.el8jbcs +8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Core ServicesFixed RHSA-2023:7626
Red Hat JBoss Core Services on RHEL 7 ServerFixed RHSA-2023:7625
Red Hat JBoss Core Services on RHEL 8Fixed RHSA-2023:7625
Not affected: 6 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Core Services on RHEL 7 Server
  • Red Hat JBoss Core Services on RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-38039
  2. 2026-10-03 Alias added: GHSA-99j9-jf36-9747
  3. 2026-10-09 Fix available: RHSA-2023:7626 · Red Hat
  4. 2026-10-31 Fix available: Red Hat JBoss Core Services · Red Hat

References

Exploit 1

Advisory 11

Other 3

See all 103 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences