CVE-2023-28319
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to...
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
- Record
CVE-2023-28319- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
- Record
CVE-2023-28319- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2023-32026
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
- Record
EUVD-2023-32026- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6xq7-qqp2-9mmc
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to...
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
- Record
GHSA-6xq7-qqp2-9mmc- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVALPINE-CVE-2023-28319
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
- Record
ALPINE-CVE-2023-28319- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVAZL-26795
CVE-2023-28319 affecting package curl for versions less than 8.2.1-1
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
- Record
AZL-26795- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 15 moreShow less
OSVAZL-26807
CVE-2023-28319 affecting package mysql for versions less than 8.0.34-1
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
- Record
AZL-26807- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVAZL-26810
CVE-2023-28319 affecting package rust for versions less than 1.72.0-2
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
- Record
AZL-26810- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVAZL-38554
CVE-2023-28319 affecting package tensorflow for versions less than 2.16.1-1
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
- Record
AZL-38554- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVBELL-CVE-2023-28319
CVE-2023-28319 does not affect BellSoft software
- Record
BELL-CVE-2023-28319- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSV
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
- Record
CVE-2023-28319- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-28319
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
- Record
DEBIAN-CVE-2023-28319- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVJLSEC-2026-407
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
- Record
JLSEC-2026-407- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2023:4629
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 security update
- Record
RHSA-2023:4629- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-28319
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
- Record
UBUNTU-CVE-2023-28319- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVCURL-CVE-2023-28319 No score
UAF in SSH sha256 fingerprint check
libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash.
This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
- Record
CURL-CVE-2023-28319- Updated
- 2026-11-02
OSVMGASA-2023-0263 No score
Updated curl packages fix security vulnerability
TELNET option IAC injection. (CVE-2023-27533)
SFTP path ~ resolving discrepancy. (CVE-2023-27534)
FTP too eager connection reuse. (CVE-2023-27535)
GSS delegation too eager connection re-use. (CVE-2023-27536)
HSTS double free. (CVE-2023-27537)
SSH connection too eager reuse still. (CVE-2023-27538)
UAF in SSH sha256 fingerprint check. (CVE-2023-28319)
siglongjmp race condition. (CVE-2023-28320)
IDN wildcard match. (CVE-2023-28321)
more POST-after-PUT confusion. (CVE-2023-28322)
HTTP headers eat all memory. (CVE-2023-38039)
- Record
MGASA-2023-0263- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12940-1 No score
curl-8.1.0-1.1 on GA media
These are all security issues fixed in the curl-8.1.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12940-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2224-1 No score
Security update for curl
This update for curl adds the following feature:
Update to version 8.0.1 (jsc#PED-2580)
- CVE-2023-28319: use-after-free in SSH sha256 fingerprint check (bsc#1211230).
- CVE-2023-28320: siglongjmp race condition (bsc#1211231).
- CVE-2023-28321: IDN wildcard matching (bsc#1211232).
- CVE-2023-28322: POST-after-PUT confusion (bsc#1211233).
- Record
SUSE-SU-2023:2224-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2224-2 No score
Security update for curl
This update for curl adds the following feature:
Update to version 8.0.1 (jsc#PED-2580)
- CVE-2023-28319: use-after-free in SSH sha256 fingerprint check (bsc#1211230).
- CVE-2023-28320: siglongjmp race condition (bsc#1211231).
- CVE-2023-28321: IDN wildcard matching (bsc#1211232).
- CVE-2023-28322: POST-after-PUT confusion (bsc#1211233).
- Record
SUSE-SU-2023:2224-2- Updated
- 2026-11-02
OSVSUSE-SU-2023:2225-1 No score
Security update for curl
This update for curl adds the following feature:
Update to version 8.0.1 (jsc#PED-2580)
- CVE-2023-28319: use-after-free in SSH sha256 fingerprint check (bsc#1211230).
- CVE-2023-28320: siglongjmp race condition (bsc#1211231).
- CVE-2023-28321: IDN wildcard matching (bsc#1211232).
- CVE-2023-28322: POST-after-PUT confusion (bsc#1211233).
- Record
SUSE-SU-2023:2225-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlAlpine:v3.15 |
before 8.1.0-r0 | 8.1.0-r0 |
curlAlpine:v3.16 |
before 8.1.0-r0 | 8.1.0-r0 |
curlAlpine:v3.17 |
before 8.1.0-r0 | 8.1.0-r0 |
curlAlpine:v3.18 |
before 8.1.0-r0 | 8.1.0-r0 |
curlAlpine:v3.19 |
before 8.1.0-r0 | 8.1.0-r0 |
curlAlpine:v3.20 |
before 8.1.0-r0 | 8.1.0-r0 |
curlAlpine:v3.21 |
before 8.1.0-r0 | 8.1.0-r0 |
curlAlpine:v3.22 |
before 8.1.0-r0 | 8.1.0-r0 |
curlAlpine:v3.23 |
before 8.1.0-r0 | 8.1.0-r0 |
curlAlpine:v3.24 |
before 8.1.0-r0 | 8.1.0-r0 |
Show 65 moreShow less
| Package | Affected | Fixed |
|---|---|---|
curlAzure Linux:2 |
before 8.2.1-1 | 8.2.1-1 |
mysqlAzure Linux:2 |
before 8.0.34-1 | 8.0.34-1 |
rustAzure Linux:2 |
before 1.72.0-2 | 1.72.0-2 |
tensorflowAzure Linux:3 |
before 2.16.1-1 | 2.16.1-1 |
curlDebian:12 |
before 7.88.1-10 | 7.88.1-10 |
curlDebian:13 |
before 7.88.1-10 | 7.88.1-10 |
curlDebian:14 |
before 7.88.1-10 | 7.88.1-10 |
CURL_jllJulia |
before 8.5.0+0 | 8.5.0+0 |
LibCURL_jllJulia |
before 8.2.1+0 | 8.2.1+0 |
curlMageia:8 From an advisory covering 11 CVEs |
before 7.74.0-1.13.mga8 | 7.74.0-1.13.mga8 |
curlMageia:9 From an advisory covering 11 CVEs |
before 7.88.1-3.1.mga9 | 7.88.1-3.1.mga9 |
jbcs-httpd24-aprRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:1.7.0-8.el7jbcs | 0:1.7.0-8.el7jbcs |
jbcs-httpd24-apr-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:1.7.0-8.el7jbcs | 0:1.7.0-8.el7jbcs |
jbcs-httpd24-apr-develRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:1.7.0-8.el7jbcs | 0:1.7.0-8.el7jbcs |
jbcs-httpd24-aprRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:1.7.0-8.el8jbcs | 0:1.7.0-8.el8jbcs |
jbcs-httpd24-apr-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:1.7.0-8.el8jbcs | 0:1.7.0-8.el8jbcs |
jbcs-httpd24-apr-develRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:1.7.0-8.el8jbcs | 0:1.7.0-8.el8jbcs |
jbcs-httpd24-httpdRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-httpd-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-httpd-develRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-httpd-manualRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-httpd-selinuxRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-httpd-toolsRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-mod_ldapRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-mod_proxy_htmlRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 1:2.4.57-5.el7jbcs | 1:2.4.57-5.el7jbcs |
jbcs-httpd24-mod_sessionRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-mod_sslRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 1:2.4.57-5.el7jbcs | 1:2.4.57-5.el7jbcs |
jbcs-httpd24-httpdRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-httpd-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-httpd-develRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-httpd-manualRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-httpd-selinuxRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-httpd-toolsRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-httpd-tools-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_ldapRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_ldap-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_proxy_htmlRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 1:2.4.57-5.el8jbcs | 1:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_proxy_html-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 1:2.4.57-5.el8jbcs | 1:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_sessionRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_session-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_sslRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 1:2.4.57-5.el8jbcs | 1:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_ssl-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 1:2.4.57-5.el8jbcs | 1:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_securityRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:2.9.3-29.el7jbcs | 0:2.9.3-29.el7jbcs |
jbcs-httpd24-mod_security-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:2.9.3-29.el7jbcs | 0:2.9.3-29.el7jbcs |
jbcs-httpd24-mod_securityRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.9.3-29.el8jbcs | 0:2.9.3-29.el8jbcs |
jbcs-httpd24-mod_security-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.9.3-29.el8jbcs | 0:2.9.3-29.el8jbcs |
jbcs-httpd24-curlRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:8.2.1-1.el7jbcs | 0:8.2.1-1.el7jbcs |
jbcs-httpd24-curl-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:8.2.1-1.el7jbcs | 0:8.2.1-1.el7jbcs |
jbcs-httpd24-libcurlRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:8.2.1-1.el7jbcs | 0:8.2.1-1.el7jbcs |
jbcs-httpd24-libcurl-develRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:8.2.1-1.el7jbcs | 0:8.2.1-1.el7jbcs |
jbcs-httpd24-curlRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:8.2.1-1.el8jbcs | 0:8.2.1-1.el8jbcs |
jbcs-httpd24-curl-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:8.2.1-1.el8jbcs | 0:8.2.1-1.el8jbcs |
jbcs-httpd24-libcurlRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:8.2.1-1.el8jbcs | 0:8.2.1-1.el8jbcs |
jbcs-httpd24-libcurl-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:8.2.1-1.el8jbcs | 0:8.2.1-1.el8jbcs |
jbcs-httpd24-libcurl-develRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:8.2.1-1.el8jbcs | 0:8.2.1-1.el8jbcs |
curlSUSE:Linux Enterprise Micro 5.3 From an advisory covering 4 CVEs |
before 8.0.1-150400.5.23.1 | 8.0.1-150400.5.23.1 |
curlSUSE:Linux Enterprise Micro 5.4 From an advisory covering 4 CVEs |
before 8.0.1-150400.5.23.1 | 8.0.1-150400.5.23.1 |
curlSUSE:Linux Enterprise Module for Basesystem 15 SP4 From an advisory covering 4 CVEs |
before 8.0.1-150400.5.23.1 | 8.0.1-150400.5.23.1 |
curlopenSUSE:Leap Micro 5.3 From an advisory covering 4 CVEs |
before 8.0.1-150400.5.23.1 | 8.0.1-150400.5.23.1 |
curlopenSUSE:Leap 15.4 From an advisory covering 4 CVEs |
before 8.0.1-150400.5.23.1 | 8.0.1-150400.5.23.1 |
curlopenSUSE:Leap 15.5 From an advisory covering 4 CVEs |
before 8.0.1-150400.5.23.1 | 8.0.1-150400.5.23.1 |
curlSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 5 CVEs |
before 8.0.1-11.65.2 | 8.0.1-11.65.2 |
curlSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 5 CVEs |
before 8.0.1-11.65.2 | 8.0.1-11.65.2 |
curlSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 5 CVEs |
before 8.0.1-11.65.2 | 8.0.1-11.65.2 |
curlopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 8.1.0-1.1 | 8.1.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-28319 is a high vulnerability (CVSS 7.5) in Haxx Curl, published May 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.49%, the 84th percentile. Fixed in curl 8.1.0-r0.
References
hackerone.com/reports/1913733
security.netapp.com/advisory/ntap-20230609-0009
support.apple.com/kb/HT213843
seclists.org/fulldisclosure/2023/Jul/52
Show 80 moreShow less
security.gentoo.org/glsa/202310-12
nvd.nist.gov/vuln/detail/CVE-2023-28319
github.com/advisories/GHSA-6xq7-qqp2-9mmc
security.alpinelinux.org/vuln/CVE-2023-28319
docs.bell-sw.com/security/cves/CVE-2023-28319
security-tracker.debian.org/tracker/CVE-2023-28319
advisories.mageia.org/MGASA-2023-0263.html
bugs.mageia.org/show_bug.cgi?id=31703
curl.se/docs/CVE-2023-27533.html
ubuntu.com/security/notices/USN-5964-1
lists.suse.com/pipermail/sle-security-updates/2023-May/014913.html
access.redhat.com/errata/RHSA-2023:4629
bugzilla.redhat.com/show_bug.cgi?id=2161773
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4629.json
cve.org/CVERecord?id=CVE-2022-24963
lists.apache.org/thread/fw9p6sdncwsjkstwc066vz57xqzfksq9
httpd.apache.org/security/vulnerabilities_24.html
suse.com/support/update/announcement/2023/suse-su-20232224-1
bugzilla.suse.com/1211230