CVE-2023-38039
However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 56.2%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 56.21% probability · 99th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-770
- Affected
- haxx/curl · fedoraproject/fedora · microsoft/windows 10 1809 · microsoft/windows 10 21h2 · microsoft/windows 10 22h2 · microsoft/windows 11 21h2 · microsoft/windows 11 22h2 · microsoft/windows 11 23h2 · microsoft/windows server 2019 · microsoft/windows server 2022
- Source
- support@hackerone.com
EPSS moved from 56.4% on 22 October 2026 to 56.2% on 3 November 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.
References
- http://seclists.org/fulldisclosure/2023/Oct/17Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jan/34Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jan/37Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jan/38Mailing List, Third Party Advisory
- https://hackerone.com/reports/2072338Exploit, Issue Tracking, Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DCZMYODALBLVOXVJEN2LF2MLANEYL4F/Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6KGKB2JNZVT276JYSKI6FV2VFJUGDOJ/Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEAWTYHC3RT6ZRS5OZRHLAIENVN6CCIS/Mailing List
- https://security.gentoo.org/glsa/202310-12Third Party Advisory
- https://security.netapp.com/advisory/ntap-20231013-0005/Third Party Advisory
- https://support.apple.com/kb/HT214036Third Party Advisory
- https://support.apple.com/kb/HT214057Third Party Advisory
- https://support.apple.com/kb/HT214058Third Party Advisory
- https://support.apple.com/kb/HT214063Third Party Advisory
- https://www.insyde.com/security-pledge/SA-2023064Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Oct/17Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jan/34Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jan/37Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jan/38Mailing List, Third Party Advisory
- https://hackerone.com/reports/2072338Exploit, Issue Tracking, Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DCZMYODALBLVOXVJEN2LF2MLANEYL4F/Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6KGKB2JNZVT276JYSKI6FV2VFJUGDOJ/Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEAWTYHC3RT6ZRS5OZRHLAIENVN6CCIS/Mailing List
- https://security.gentoo.org/glsa/202310-12Third Party Advisory
- https://security.netapp.com/advisory/ntap-20231013-0005/Third Party Advisory
- https://support.apple.com/kb/HT214036Third Party Advisory
- https://support.apple.com/kb/HT214057Third Party Advisory
- https://support.apple.com/kb/HT214058Third Party Advisory
- https://support.apple.com/kb/HT214063Third Party Advisory
- https://www.insyde.com/security-pledge/SA-2023064Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.