CVE-2023-27537
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate ...
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
- Record
CVE-2023-27537- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-415
- Updated
- 2026-11-03
CVE List No score
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
- Record
CVE-2023-27537- Weakness
- CWE-415
- Updated
- 2026-11-03
EUVDEUVD-2023-31292 No score
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
- Record
EUVD-2023-31292- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9j2c-vm53-wcvm
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate ...
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
- Record
GHSA-9j2c-vm53-wcvm- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
OSVALPINE-CVE-2023-27537
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
- Record
ALPINE-CVE-2023-27537- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-25852
CVE-2023-27537 affecting package mysql for versions less than 8.0.33-1
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
- Record
AZL-25852- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 10 moreShow less
OSVAZL-25858
CVE-2023-27537 affecting package rust for versions less than 1.72.0-2
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
- Record
AZL-25858- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-34603
CVE-2023-27537 affecting package cmake for versions less than 3.28.2-1
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
- Record
AZL-34603- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-38114
CVE-2023-27537 affecting package tensorflow for versions less than 2.16.1-1
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
- Record
AZL-38114- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2023-27537
CVE-2023-27537 does not affect BellSoft software
- Record
BELL-CVE-2023-27537- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-27537
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
- Record
DEBIAN-CVE-2023-27537- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVJLSEC-2025-32
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate...
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
- Record
JLSEC-2025-32- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCURL-CVE-2023-27537 No score
HSTS double free
libcurl supports sharing HSTS data between separate "handles". This sharing was introduced without considerations for doing this sharing across separate threads but there was no indication of this fact in the documentation.
Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double free or use after free.
- Record
CURL-CVE-2023-27537- Updated
- 2026-11-02
OSV No score
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
- Record
CVE-2023-27537- Weakness
- CWE-415
- Updated
- 2026-11-04
OSVMGASA-2023-0263 No score
Updated curl packages fix security vulnerability
TELNET option IAC injection. (CVE-2023-27533)
SFTP path ~ resolving discrepancy. (CVE-2023-27534)
FTP too eager connection reuse. (CVE-2023-27535)
GSS delegation too eager connection re-use. (CVE-2023-27536)
HSTS double free. (CVE-2023-27537)
SSH connection too eager reuse still. (CVE-2023-27538)
UAF in SSH sha256 fingerprint check. (CVE-2023-28319)
siglongjmp race condition. (CVE-2023-28320)
IDN wildcard match. (CVE-2023-28321)
more POST-after-PUT confusion. (CVE-2023-28322)
HTTP headers eat all memory. (CVE-2023-38039)
- Record
MGASA-2023-0263- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12812-1 No score
curl-8.0.1-1.1 on GA media
These are all security issues fixed in the curl-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12812-1- Updated
- 2026-11-02
Affected products
- haxx libcurl
- broadcom brocade fabric operating system firmware
- netapp active iq unified manager
- netapp clustered data ontap
- netapp h300s firmware
- netapp h410s firmware
- netapp h500s firmware
- netapp h700s firmware
- siemens simatic s7-1500 cpu 1518-4 pn/dp mfp
- siemens simatic s7-1500 cpu 1518f-4 pn/dp mfp
- siemens siplus s7-1500 cpu 1518-4 pn/dp mfp
- splunk universal forwarder
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlAlpine:v3.14 |
before 8.0.1-r0 | 8.0.1-r0 |
curlAlpine:v3.15 |
before 8.0.1-r0 | 8.0.1-r0 |
curlAlpine:v3.16 |
before 8.0.1-r0 | 8.0.1-r0 |
curlAlpine:v3.17 |
before 7.88.1-r1 | 7.88.1-r1 |
curlAlpine:v3.18 |
before 8.0.0-r0 | 8.0.0-r0 |
curlAlpine:v3.19 |
before 8.0.0-r0 | 8.0.0-r0 |
curlAlpine:v3.20 |
before 8.0.0-r0 | 8.0.0-r0 |
curlAlpine:v3.21 |
before 8.0.0-r0 | 8.0.0-r0 |
curlAlpine:v3.22 |
before 8.0.0-r0 | 8.0.0-r0 |
curlAlpine:v3.23 |
before 8.0.0-r0 | 8.0.0-r0 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
curlAlpine:v3.24 |
before 8.0.0-r0 | 8.0.0-r0 |
mysqlAzure Linux:2 |
before 8.0.33-1 | 8.0.33-1 |
rustAzure Linux:2 |
before 1.72.0-2 | 1.72.0-2 |
cmakeAzure Linux:3 |
before 3.28.2-1 | 3.28.2-1 |
tensorflowAzure Linux:3 |
before 2.16.1-1 | 2.16.1-1 |
curlDebian:12 |
before 7.88.1-7 | 7.88.1-7 |
curlDebian:13 |
before 7.88.1-7 | 7.88.1-7 |
curlDebian:14 |
before 7.88.1-7 | 7.88.1-7 |
LibCURL_jllJulia |
7.88.1+0 up to 8.0.1+0 | 8.0.1+0 |
curlMageia:8 From an advisory covering 11 CVEs |
before 7.74.0-1.13.mga8 | 7.74.0-1.13.mga8 |
curlMageia:9 From an advisory covering 11 CVEs |
before 7.88.1-3.1.mga9 | 7.88.1-3.1.mga9 |
curlopenSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 8.0.1-1.1 | 8.0.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | CVE List, EUVD, NVD, OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-27537 is a medium vulnerability (CVSS 5.9) in Haxx Libcurl, published March 20, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.90%, the 79th percentile. Fixed in curl 8.0.1-r0.
References
hackerone.com/reports/1897203
security.netapp.com/advisory/ntap-20230420-0010
security.gentoo.org/glsa/202310-12
cert-portal.siemens.com/productcert/html/ssa-398330.html
nvd.nist.gov/vuln/detail/CVE-2023-27537
Show 28 moreShow less
github.com/advisories/GHSA-9j2c-vm53-wcvm
security.alpinelinux.org/vuln/CVE-2023-27537
docs.bell-sw.com/security/cves/CVE-2023-27537
security-tracker.debian.org/tracker/CVE-2023-27537
advisories.mageia.org/MGASA-2023-0263.html
bugs.mageia.org/show_bug.cgi?id=31703
curl.se/docs/CVE-2023-27533.html
ubuntu.com/security/notices/USN-5964-1
lists.suse.com/pipermail/sle-security-updates/2023-May/014913.html
suse.com/security/cve/CVE-2023-27533