Every CVE Search/ Get API key

CVE-2023-28320

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several...

5.9 MediumFix available

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.66%Up 2.6 points since May 27, 2023
90%50%10%1%

What each source reports

NVD Score used 5.9

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

Record
CVE-2023-28320
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-362
Updated
2026-11-02
CVE List 5.9

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

Record
CVE-2023-28320
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2023-32027 5.9

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

Record
EUVD-2023-32027
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-c8wj-435x-f2cc 5.9

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several...

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

Record
GHSA-c8wj-435x-f2cc
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-362, CWE-400
Updated
2026-11-02
OSVALPINE-CVE-2023-28320 5.9

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

Record
ALPINE-CVE-2023-28320
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-26790 5.9

CVE-2023-28320 affecting package cmake for versions less than 3.21.4-11

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

Record
AZL-26790
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 19 moreShow less
OSVAZL-26793 5.9

CVE-2023-28320 affecting package curl for versions less than 8.2.1-1

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

Record
AZL-26793
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-26809 5.9

CVE-2023-28320 affecting package mysql for versions less than 8.0.34-1

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

Record
AZL-26809
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-26813 5.9

CVE-2023-28320 affecting package rust for versions less than 1.72.0-2

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

Record
AZL-26813
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-34605 5.9

CVE-2023-28320 affecting package cmake for versions less than 3.28.2-1

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

Record
AZL-34605
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-38926 5.9

CVE-2023-28320 affecting package tensorflow for versions less than 2.16.1-1

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

Record
AZL-38926
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2023-28320 5.9

CVE-2023-28320 does not affect BellSoft software

Record
BELL-CVE-2023-28320
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 5.9

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

Record
CVE-2023-28320
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVDEBIAN-CVE-2023-28320 5.9

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

Record
DEBIAN-CVE-2023-28320
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVJLSEC-2026-408 5.9

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

Record
JLSEC-2026-408
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCURL-CVE-2023-28320 No score

siglongjmp race condition

libcurl provides several different backends for resolving hostnames, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp().

When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

Record
CURL-CVE-2023-28320
Updated
2026-11-02
OSVMGASA-2023-0263 No score

Updated curl packages fix security vulnerability

TELNET option IAC injection. (CVE-2023-27533)

SFTP path ~ resolving discrepancy. (CVE-2023-27534)

FTP too eager connection reuse. (CVE-2023-27535)

GSS delegation too eager connection re-use. (CVE-2023-27536)

HSTS double free. (CVE-2023-27537)

SSH connection too eager reuse still. (CVE-2023-27538)

UAF in SSH sha256 fingerprint check. (CVE-2023-28319)

siglongjmp race condition. (CVE-2023-28320)

IDN wildcard match. (CVE-2023-28321)

more POST-after-PUT confusion. (CVE-2023-28322)

HTTP headers eat all memory. (CVE-2023-38039)

Record
MGASA-2023-0263
Updated
2026-11-02
OSVopenSUSE-SU-2024:12940-1 No score

curl-8.1.0-1.1 on GA media

These are all security issues fixed in the curl-8.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12940-1
Updated
2026-11-02
OSVSUSE-SU-2023:2224-1 No score

Security update for curl

This update for curl adds the following feature:

Update to version 8.0.1 (jsc#PED-2580)

  • CVE-2023-28319: use-after-free in SSH sha256 fingerprint check (bsc#1211230).
  • CVE-2023-28320: siglongjmp race condition (bsc#1211231).
  • CVE-2023-28321: IDN wildcard matching (bsc#1211232).
  • CVE-2023-28322: POST-after-PUT confusion (bsc#1211233).
Record
SUSE-SU-2023:2224-1
Updated
2026-11-02
OSVSUSE-SU-2023:2224-2 No score

Security update for curl

This update for curl adds the following feature:

Update to version 8.0.1 (jsc#PED-2580)

  • CVE-2023-28319: use-after-free in SSH sha256 fingerprint check (bsc#1211230).
  • CVE-2023-28320: siglongjmp race condition (bsc#1211231).
  • CVE-2023-28321: IDN wildcard matching (bsc#1211232).
  • CVE-2023-28322: POST-after-PUT confusion (bsc#1211233).
Record
SUSE-SU-2023:2224-2
Updated
2026-11-02
OSVSUSE-SU-2023:2225-1 No score

Security update for curl

This update for curl adds the following feature:

Update to version 8.0.1 (jsc#PED-2580)

  • CVE-2023-28319: use-after-free in SSH sha256 fingerprint check (bsc#1211230).
  • CVE-2023-28320: siglongjmp race condition (bsc#1211231).
  • CVE-2023-28321: IDN wildcard matching (bsc#1211232).
  • CVE-2023-28322: POST-after-PUT confusion (bsc#1211233).
Record
SUSE-SU-2023:2225-1
Updated
2026-11-02
OSVSUSE-SU-2023:2226-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2023-28320: Fixed siglongjmp race condition (bsc#1211231).
  • CVE-2023-28321: Fixed IDN wildcard matching (bsc#1211232).
  • CVE-2023-28322: Fixed POST-after-PUT confusion (bsc#1211233).
  • CVE-2023-27533: Fixed TELNET option IAC injection (bsc#1209209).
  • CVE-2023-27534: Fixed SFTP path ~ resolving discrepancy (bsc#1209210).
  • CVE-2023-27535: Fixed FTP too eager connection reuse (bsc#1209211).
  • CVE-2023-27536: Fixed GSS delegation too eager connection reuse (bsc#1209212).
  • CVE-2023-27538: Fixed SSH connection too eager reuse still (bsc#1209214).
  • CVE-2022-43552: HTTP Proxy deny use-after-free (bsc#1206309).
  • CVE-2023-23916: Fixed HTTP multi-header compression denial of service (bsc#1207992).
Record
SUSE-SU-2023:2226-1
Updated
2026-11-02
OSVSUSE-SU-2023:2227-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2023-28320: Fixed siglongjmp race condition (bsc#1211231).
  • CVE-2023-28321: Fixed IDN wildcard matching (bsc#1211232).
  • CVE-2023-28322: Fixed POST-after-PUT confusion (bsc#1211233).
Record
SUSE-SU-2023:2227-1
Updated
2026-11-02
OSVSUSE-SU-2023:2228-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2023-28320: Fixed siglongjmp race condition (bsc#1211231).
  • CVE-2023-28321: Fixed IDN wildcard matching (bsc#1211232).
  • CVE-2023-28322: Fixed POST-after-PUT confusion (bsc#1211233).
  • CVE-2023-27533: Fixed TELNET option IAC injection (bsc#1209209).
  • CVE-2023-27534: Fixed SFTP path ~ resolving discrepancy (bsc#1209210).
  • CVE-2023-27535: Fixed FTP too eager connection reuse (bsc#1209211).
  • CVE-2023-27536: Fixed GSS delegation too eager connection reuse (bsc#1209212).
  • CVE-2023-27538: Fixed SSH connection too eager reuse still (bsc#1209214).
  • CVE-2022-43552: HTTP Proxy deny use-after-free (bsc#1206309).
  • CVE-2023-23916: Fixed HTTP multi-header compression denial of service (bsc#1207992).
Record
SUSE-SU-2023:2228-1
Updated
2026-11-02
OSVSUSE-SU-2023:2230-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2023-28320: Fixed siglongjmp race condition (bsc#1211231).
  • CVE-2023-28321: Fixed IDN wildcard matching (bsc#1211232).
  • CVE-2023-28322: Fixed POST-after-PUT confusion (bsc#1211233).
Record
SUSE-SU-2023:2230-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
curl
Alpine:v3.15
before 8.1.0-r0
8.1.0-r0
curl
Alpine:v3.16
before 8.1.0-r0
8.1.0-r0
curl
Alpine:v3.17
before 8.1.0-r0
8.1.0-r0
curl
Alpine:v3.18
before 8.1.0-r0
8.1.0-r0
curl
Alpine:v3.19
before 8.1.0-r0
8.1.0-r0
curl
Alpine:v3.20
before 8.1.0-r0
8.1.0-r0
curl
Alpine:v3.21
before 8.1.0-r0
8.1.0-r0
curl
Alpine:v3.22
before 8.1.0-r0
8.1.0-r0
curl
Alpine:v3.23
before 8.1.0-r0
8.1.0-r0
curl
Alpine:v3.24
before 8.1.0-r0
8.1.0-r0
Show 47 moreShow less
Affected packages
PackageAffectedFixed
cmake
Azure Linux:2
before 3.21.4-11
3.21.4-11
curl
Azure Linux:2
before 8.2.1-1
8.2.1-1
mysql
Azure Linux:2
before 8.0.34-1
8.0.34-1
rust
Azure Linux:2
before 1.72.0-2
1.72.0-2
cmake
Azure Linux:3
before 3.28.2-1
3.28.2-1
tensorflow
Azure Linux:3
before 2.16.1-1
2.16.1-1
curl
Debian:12
before 7.88.1-10
7.88.1-10
curl
Debian:13
before 7.88.1-10
7.88.1-10
curl
Debian:14
before 7.88.1-10
7.88.1-10
CURL_jll
Julia
before 8.5.0+0
8.5.0+0
LibCURL_jll
Julia
before 8.2.1+0
8.2.1+0
curl
Mageia:8
From an advisory covering 11 CVEs
before 7.74.0-1.13.mga8
7.74.0-1.13.mga8
curl
Mageia:9
From an advisory covering 11 CVEs
before 7.88.1-3.1.mga9
7.88.1-3.1.mga9
curl
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 4 CVEs
before 8.0.1-150400.5.23.1
8.0.1-150400.5.23.1
curl
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 4 CVEs
before 8.0.1-150400.5.23.1
8.0.1-150400.5.23.1
curl
SUSE:Linux Enterprise Module for Basesystem 15 SP4
From an advisory covering 4 CVEs
before 8.0.1-150400.5.23.1
8.0.1-150400.5.23.1
curl
openSUSE:Leap Micro 5.3
From an advisory covering 4 CVEs
before 8.0.1-150400.5.23.1
8.0.1-150400.5.23.1
curl
openSUSE:Leap 15.4
From an advisory covering 4 CVEs
before 8.0.1-150400.5.23.1
8.0.1-150400.5.23.1
curl
openSUSE:Leap 15.5
From an advisory covering 4 CVEs
before 8.0.1-150400.5.23.1
8.0.1-150400.5.23.1
curl
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 5 CVEs
before 8.0.1-11.65.2
8.0.1-11.65.2
curl
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 5 CVEs
before 8.0.1-11.65.2
8.0.1-11.65.2
curl
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 5 CVEs
before 8.0.1-11.65.2
8.0.1-11.65.2
curl
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 10 CVEs
before 7.60.0-150000.51.1
7.60.0-150000.51.1
curl
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 10 CVEs
before 7.60.0-150000.51.1
7.60.0-150000.51.1
curl
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 10 CVEs
before 7.60.0-150000.51.1
7.60.0-150000.51.1
curl
SUSE:Enterprise Storage 6
From an advisory covering 10 CVEs
before 7.60.0-150000.51.1
7.60.0-150000.51.1
curl
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 3 CVEs
before 7.66.0-150200.4.57.1
7.66.0-150200.4.57.1
curl
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
From an advisory covering 3 CVEs
before 7.66.0-150200.4.57.1
7.66.0-150200.4.57.1
curl
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 3 CVEs
before 7.66.0-150200.4.57.1
7.66.0-150200.4.57.1
curl
SUSE:Linux Enterprise Real Time 15 SP3
From an advisory covering 3 CVEs
before 7.66.0-150200.4.57.1
7.66.0-150200.4.57.1
curl
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 3 CVEs
before 7.66.0-150200.4.57.1
7.66.0-150200.4.57.1
curl
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 3 CVEs
before 7.66.0-150200.4.57.1
7.66.0-150200.4.57.1
curl
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 3 CVEs
before 7.66.0-150200.4.57.1
7.66.0-150200.4.57.1
curl
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 3 CVEs
before 7.66.0-150200.4.57.1
7.66.0-150200.4.57.1
curl
SUSE:Manager Proxy 4.2
From an advisory covering 3 CVEs
before 7.66.0-150200.4.57.1
7.66.0-150200.4.57.1
curl
SUSE:Manager Server 4.2
From an advisory covering 3 CVEs
before 7.66.0-150200.4.57.1
7.66.0-150200.4.57.1
curl
SUSE:Linux Enterprise Micro 5.1
From an advisory covering 3 CVEs
before 7.66.0-150200.4.57.1
7.66.0-150200.4.57.1
curl
SUSE:Linux Enterprise Micro 5.2
From an advisory covering 3 CVEs
before 7.66.0-150200.4.57.1
7.66.0-150200.4.57.1
curl
SUSE:Enterprise Storage 7
From an advisory covering 3 CVEs
before 7.66.0-150200.4.57.1
7.66.0-150200.4.57.1
curl
SUSE:Enterprise Storage 7.1
From an advisory covering 3 CVEs
before 7.66.0-150200.4.57.1
7.66.0-150200.4.57.1
curl
SUSE:OpenStack Cloud 9
From an advisory covering 10 CVEs
before 7.60.0-4.56.1
7.60.0-4.56.1
curl
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 10 CVEs
before 7.60.0-4.56.1
7.60.0-4.56.1
curl
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 10 CVEs
before 7.60.0-4.56.1
7.60.0-4.56.1
curl
SUSE:Linux Enterprise Server 12 SP4-ESPOS
From an advisory covering 10 CVEs
before 7.60.0-4.56.1
7.60.0-4.56.1
curl
SUSE:Linux Enterprise Server 12 SP4-LTSS
From an advisory covering 10 CVEs
before 7.60.0-4.56.1
7.60.0-4.56.1
curl
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 3 CVEs
before 7.37.0-37.98.1
7.37.0-37.98.1
curl
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
before 8.1.0-1.1
8.1.0-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-28320 is a medium vulnerability (CVSS 5.9) in Haxx Curl, published May 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.66%, the 85th percentile. Fixed in curl 8.1.0-r0.

References

Show 58 moreShow less
MoveEnter Open