Is CVE-2023-23916 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 2%.

What products does CVE-2023-23916 affect?

Tracked products affected include curl. Check the version you run to see whether it is affected.

How do I fix CVE-2023-23916?

Apply the vendor fix in your normal patch cycle. Upgrade affected products to a fixed version.

CVE-2023-23916

Q: What is CVE-2023-23916?

CVE-2023-23916 is a medium-severity software vulnerability (Resource exhaustion) with a CVSS score of 6.5. An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with different

MEDIUM severity · CVSS 6.5 · Resource exhaustion

6.5CVSS MEDIUM

Summary

An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

Confidentiality impactNone

Integrity impactNone

Availability impactHigh

Exploit probability (EPSS)2%

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products we track (1)

curl

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

CVE-2023-23916

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information