CVE-2023-28319
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.49%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 2.49% probability · 85th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-416
- Affected
- haxx/curl · apple/macos · netapp/clustered data ontap · netapp/ontap antivirus connector · netapp/h300s firmware · netapp/h500s firmware · netapp/h700s firmware · netapp/h410s firmware
- Source
- support@hackerone.com
EPSS 2.5% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://seclists.org/fulldisclosure/2023/Jul/47Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jul/48Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jul/52Mailing List, Third Party Advisory
- https://hackerone.com/reports/1913733Exploit, Patch, Third Party Advisory
- https://security.gentoo.org/glsa/202310-12Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230609-0009/Third Party Advisory
- https://support.apple.com/kb/HT213843Third Party Advisory
- https://support.apple.com/kb/HT213844Third Party Advisory
- https://support.apple.com/kb/HT213845Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jul/47Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jul/48Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jul/52Mailing List, Third Party Advisory
- https://hackerone.com/reports/1913733Exploit, Patch, Third Party Advisory
- https://security.gentoo.org/glsa/202310-12Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230609-0009/Third Party Advisory
- https://support.apple.com/kb/HT213843Third Party Advisory
- https://support.apple.com/kb/HT213844Third Party Advisory
- https://support.apple.com/kb/HT213845Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.