JLSEC-2026-1342

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-1342.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-1342.json

JSON Data

https://api.osv.dev/v1/vulns/JLSEC-2026-1342

Upstream

CVE-2023-38039

EUVD-2023-41865

GHSA-99j9-jf36-9747

Published

2026-08-17T13:15:13.400Z

Modified

2026-08-17T13:44:05.759306517Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed...

Details

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API.

However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.

Database specific

{
    "sources": [
        {
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38039",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-38039",
            "modified": "2026-06-17T06:09:17.450Z",
            "id": "CVE-2023-38039",
            "published": "2023-09-15T04:15:10.127Z",
            "imported": "2026-08-16T08:05:13.277Z",
            "database_specific": {
                "status": "Modified"
            }
        },
        {
            "html_url": "https://github.com/advisories/GHSA-99j9-jf36-9747",
            "published": "2023-09-15T06:30:18Z",
            "id": "GHSA-99j9-jf36-9747",
            "modified": "2024-04-01T18:30:56Z",
            "imported": "2026-08-16T08:06:45.398Z",
            "url": "https://api.github.com/advisories/GHSA-99j9-jf36-9747"
        },
        {
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-41865",
            "modified": "2025-12-02T20:06:21Z",
            "id": "EUVD-2023-41865",
            "published": "2023-09-15T03:21:54Z",
            "imported": "2026-08-16T08:06:26.884Z",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2023-41865"
        }
    ],
    "license": "CC-BY-4.0"
}

References

Affected packages

Julia / LibCURL_jll

Package

Name: LibCURL_jll
Purl: pkg:julia/LibCURL_jll?uuid=deac9b47-8bc7-5906-a0fe-35ac56dc84c0

Affected ranges

Type: SEMVER
Events: Introduced

7.84.0+0

Fixed

8.4.0+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-1342.json"