CURL-CVE-2023-23916

See a problem?
Please try reporting it to the source first.
Source
https://curl.se/docs/CVE-2023-23916.html
Import Source
https://curl.se/docs/CURL-CVE-2023-23916.json
JSON Data
https://api.osv.dev/v1/vulns/CURL-CVE-2023-23916
Aliases
Published
2023-02-15T08:00:00Z
Modified
2025-05-15T17:48:29Z
Summary
HTTP multi-header compression denial of service
Details

curl supports "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was capped, but the cap was implemented on a per-header basis allowing a malicious server to insert a virtually unlimited number of compression steps simply by using many headers.

The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.

Database specific 
{
    "issue": "https://hackerone.com/reports/1826048",
    "package": "curl",
    "last_affected": "7.87.0",
    "www": "https://curl.se/docs/CVE-2023-23916.html",
    "CWE": {
        "id": "CWE-770",
        "desc": "Allocation of Resources Without Limits or Throttling"
    },
    "award": {
        "amount": "2400",
        "currency": "USD"
    },
    "affects": "both",
    "severity": "Medium",
    "URL": "https://curl.se/docs/CVE-2023-23916.json"
}
References
Credits
    • Patrick Monnerat - FINDER
    • Patrick Monnerat - REMEDIATION_DEVELOPER

Affected packages

Git / github.com/curl/curl.git

Affected ranges

Type
SEMVER
Events
Introduced
7.57.0
Fixed
7.88.0
Type
GIT
Repo
https://github.com/curl/curl.git
Events
Introduced
dbcced8e32b50c068ac297106f0502ee200a1ebd
Fixed
119fb187192a9ea13dc90d9d20c215fc82799ab9

Affected versions

7.*

7.57.0
7.58.0
7.59.0
7.60.0
7.61.0
7.61.1
7.62.0
7.63.0
7.64.0
7.64.1
7.65.0
7.65.1
7.65.2
7.65.3
7.66.0
7.67.0
7.68.0
7.69.0
7.69.1
7.70.0
7.71.0
7.71.1
7.72.0
7.73.0
7.74.0
7.75.0
7.76.0
7.76.1
7.77.0
7.78.0
7.79.0
7.79.1
7.80.0
7.81.0
7.82.0
7.83.0
7.83.1
7.84.0
7.85.0
7.86.0
7.87.0

Database specific

vanir_signatures

[
    {
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "Curl_build_unencoding_stack",
            "file": "lib/content_encoding.c"
        },
        "digest": {
            "function_hash": "236136722379571766480436126468880933004",
            "length": 1391.0
        },
        "source": "https://github.com/curl/curl.git/commit/119fb187192a9ea13dc90d9d20c215fc82799ab9",
        "signature_type": "Function",
        "id": "CURL-CVE-2023-23916-04d4e0af"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "lib/content_encoding.c"
        },
        "digest": {
            "line_hashes": [
                "225682655952001326715220674207391006600",
                "285785662562700632386988265942516493028",
                "203103347077643510629770777772191475331",
                "281980678149956129927863230221465799883",
                "114552470392839331261066750353470777076",
                "309703287710777946316441318192642982340",
                "226005546279310649221062165644729979516",
                "269037724858927312323434386765073202848",
                "318480930092771807115527444739740201889",
                "13531748173703579674894831209765224433"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/curl/curl.git/commit/119fb187192a9ea13dc90d9d20c215fc82799ab9",
        "signature_type": "Line",
        "id": "CURL-CVE-2023-23916-399d64d5"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "lib/urldata.h"
        },
        "digest": {
            "line_hashes": [
                "314691222874946517552656372691008466937",
                "169853910395093266110753057715160474849",
                "189328306042192910930881936581626190490",
                "27503069412827551803451655498114064704"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/curl/curl.git/commit/119fb187192a9ea13dc90d9d20c215fc82799ab9",
        "signature_type": "Line",
        "id": "CURL-CVE-2023-23916-d069efcb"
    }
]