CURL-CVE-2023-23916

Source

https://curl.se/docs/CVE-2023-23916.html

Import Source

https://curl.se/docs/CURL-CVE-2023-23916.json

Aliases

• CVE-2023-23916

Published

2023-02-15T08:00:00Z

Modified

2024-01-25T02:42:51.616583Z

Details

curl supports "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was capped, but the cap was implemented on a per-header basis allowing a malicious server to insert a virtually unlimited number of compression steps simply by using many headers.

The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.

References