PT-2023-2340 · Libcurl+3 · Libcurl+3
Published
2023-03-20
·
Updated
2026-05-18
·
CVE-2023-27537
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
libcurl versions prior to 8.0.0
Description
A double free vulnerability exists in libcurl when sharing HSTS data between separate handles. This sharing was introduced without considerations for doing this sharing across separate threads, but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free. The vulnerability may allow a remote attacker to execute a double-free or use-after-free, potentially resulting in a denial of service condition.
Recommendations
For libcurl versions prior to 8.0.0, consider disabling the sharing of HSTS data between separate handles until a patch is available. As a temporary workaround, restrict access to the HSTS data to minimize the risk of exploitation. Avoid using the shared HSTS data in multi-threaded environments until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Double Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Ibm Aix
Red Os
Libcurl