CVE-2023-28320
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time.
Does this matter?
Lower severity and a low EPSS score (2.66%). Track it; it rarely justifies an emergency change on its own.
Description
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 2.66% probability · 86th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-400, CWE-362
- Affected
- haxx/curl · apple/macos · netapp/clustered data ontap · netapp/ontap antivirus connector · netapp/h300s firmware · netapp/h500s firmware · netapp/h700s firmware · netapp/h410s firmware
- Source
- support@hackerone.com
EPSS 2.7% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://seclists.org/fulldisclosure/2023/Jul/47Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jul/48Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jul/52Mailing List, Third Party Advisory
- https://hackerone.com/reports/1929597Exploit, Patch, Third Party Advisory
- https://security.gentoo.org/glsa/202310-12Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230609-0009/Third Party Advisory
- https://support.apple.com/kb/HT213843Third Party Advisory
- https://support.apple.com/kb/HT213844Third Party Advisory
- https://support.apple.com/kb/HT213845Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jul/47Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jul/48Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jul/52Mailing List, Third Party Advisory
- https://hackerone.com/reports/1929597Exploit, Patch, Third Party Advisory
- https://security.gentoo.org/glsa/202310-12Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230609-0009/Third Party Advisory
- https://support.apple.com/kb/HT213843Third Party Advisory
- https://support.apple.com/kb/HT213844Third Party Advisory
- https://support.apple.com/kb/HT213845Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.