PT-2023-6817 · Curl+11 · Curl+11
Patrick Monnerat
·
Published
2023-02-15
·
Updated
2026-05-18
·
CVE-2023-23916
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
curl versions prior to 7.88.0
Description
A flaw in the "chained" HTTP compression algorithms in curl allows a malicious server to insert a virtually unlimited number of compression steps by using many headers, potentially resulting in a denial of service condition due to excessive memory allocation. This could lead to curl spending enormous amounts of allocated heap memory or returning out of memory errors. The issue is related to the decompression chain, where the number of acceptable "links" was capped on a per-header basis, allowing for unlimited compression steps.
Recommendations
For versions prior to 7.88.0, update to version 7.88.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
curl command with multiple compression algorithms to minimize the risk of exploitation. Avoid using the curl command with servers that use multiple headers for compression until the issue is resolved. At the moment, there is no other information about additional mitigation measures.Exploit
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Ibm Aix
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Curl