CVE-2023-28320
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several...
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
5.9
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
- Record
CVE-2023-28320- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-362
- Updated
- 2026-11-02
CVE List
5.9
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
- Record
CVE-2023-28320- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2023-32027
5.9
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
- Record
EUVD-2023-32027- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c8wj-435x-f2cc
5.9
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several...
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
- Record
GHSA-c8wj-435x-f2cc- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-362, CWE-400
- Updated
- 2026-11-02
OSVALPINE-CVE-2023-28320
5.9
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
- Record
ALPINE-CVE-2023-28320- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-26790
5.9
CVE-2023-28320 affecting package cmake for versions less than 3.21.4-11
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
- Record
AZL-26790- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 19 moreShow less
OSVAZL-26793
5.9
CVE-2023-28320 affecting package curl for versions less than 8.2.1-1
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
- Record
AZL-26793- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-26809
5.9
CVE-2023-28320 affecting package mysql for versions less than 8.0.34-1
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
- Record
AZL-26809- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-26813
5.9
CVE-2023-28320 affecting package rust for versions less than 1.72.0-2
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
- Record
AZL-26813- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-34605
5.9
CVE-2023-28320 affecting package cmake for versions less than 3.28.2-1
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
- Record
AZL-34605- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-38926
5.9
CVE-2023-28320 affecting package tensorflow for versions less than 2.16.1-1
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
- Record
AZL-38926- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2023-28320
5.9
CVE-2023-28320 does not affect BellSoft software
- Record
BELL-CVE-2023-28320- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
5.9
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
- Record
CVE-2023-28320- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-28320
5.9
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
- Record
DEBIAN-CVE-2023-28320- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVJLSEC-2026-408
5.9
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
- Record
JLSEC-2026-408- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCURL-CVE-2023-28320 No score
siglongjmp race condition
libcurl provides several different backends for resolving hostnames, selected
at build time. If it is built to use the synchronous resolver, it allows name
resolves to time-out slow operations using alarm() and siglongjmp().
When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
- Record
CURL-CVE-2023-28320- Updated
- 2026-11-02
OSVMGASA-2023-0263 No score
Updated curl packages fix security vulnerability
TELNET option IAC injection. (CVE-2023-27533)
SFTP path ~ resolving discrepancy. (CVE-2023-27534)
FTP too eager connection reuse. (CVE-2023-27535)
GSS delegation too eager connection re-use. (CVE-2023-27536)
HSTS double free. (CVE-2023-27537)
SSH connection too eager reuse still. (CVE-2023-27538)
UAF in SSH sha256 fingerprint check. (CVE-2023-28319)
siglongjmp race condition. (CVE-2023-28320)
IDN wildcard match. (CVE-2023-28321)
more POST-after-PUT confusion. (CVE-2023-28322)
HTTP headers eat all memory. (CVE-2023-38039)
- Record
MGASA-2023-0263- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12940-1 No score
curl-8.1.0-1.1 on GA media
These are all security issues fixed in the curl-8.1.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12940-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2224-1 No score
Security update for curl
This update for curl adds the following feature:
Update to version 8.0.1 (jsc#PED-2580)
- CVE-2023-28319: use-after-free in SSH sha256 fingerprint check (bsc#1211230).
- CVE-2023-28320: siglongjmp race condition (bsc#1211231).
- CVE-2023-28321: IDN wildcard matching (bsc#1211232).
- CVE-2023-28322: POST-after-PUT confusion (bsc#1211233).
- Record
SUSE-SU-2023:2224-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2224-2 No score
Security update for curl
This update for curl adds the following feature:
Update to version 8.0.1 (jsc#PED-2580)
- CVE-2023-28319: use-after-free in SSH sha256 fingerprint check (bsc#1211230).
- CVE-2023-28320: siglongjmp race condition (bsc#1211231).
- CVE-2023-28321: IDN wildcard matching (bsc#1211232).
- CVE-2023-28322: POST-after-PUT confusion (bsc#1211233).
- Record
SUSE-SU-2023:2224-2- Updated
- 2026-11-02
OSVSUSE-SU-2023:2225-1 No score
Security update for curl
This update for curl adds the following feature:
Update to version 8.0.1 (jsc#PED-2580)
- CVE-2023-28319: use-after-free in SSH sha256 fingerprint check (bsc#1211230).
- CVE-2023-28320: siglongjmp race condition (bsc#1211231).
- CVE-2023-28321: IDN wildcard matching (bsc#1211232).
- CVE-2023-28322: POST-after-PUT confusion (bsc#1211233).
- Record
SUSE-SU-2023:2225-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2226-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2023-28320: Fixed siglongjmp race condition (bsc#1211231).
- CVE-2023-28321: Fixed IDN wildcard matching (bsc#1211232).
- CVE-2023-28322: Fixed POST-after-PUT confusion (bsc#1211233).
- CVE-2023-27533: Fixed TELNET option IAC injection (bsc#1209209).
- CVE-2023-27534: Fixed SFTP path ~ resolving discrepancy (bsc#1209210).
- CVE-2023-27535: Fixed FTP too eager connection reuse (bsc#1209211).
- CVE-2023-27536: Fixed GSS delegation too eager connection reuse (bsc#1209212).
- CVE-2023-27538: Fixed SSH connection too eager reuse still (bsc#1209214).
- CVE-2022-43552: HTTP Proxy deny use-after-free (bsc#1206309).
- CVE-2023-23916: Fixed HTTP multi-header compression denial of service (bsc#1207992).
- Record
SUSE-SU-2023:2226-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2227-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2023-28320: Fixed siglongjmp race condition (bsc#1211231).
- CVE-2023-28321: Fixed IDN wildcard matching (bsc#1211232).
- CVE-2023-28322: Fixed POST-after-PUT confusion (bsc#1211233).
- Record
SUSE-SU-2023:2227-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2228-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2023-28320: Fixed siglongjmp race condition (bsc#1211231).
- CVE-2023-28321: Fixed IDN wildcard matching (bsc#1211232).
- CVE-2023-28322: Fixed POST-after-PUT confusion (bsc#1211233).
- CVE-2023-27533: Fixed TELNET option IAC injection (bsc#1209209).
- CVE-2023-27534: Fixed SFTP path ~ resolving discrepancy (bsc#1209210).
- CVE-2023-27535: Fixed FTP too eager connection reuse (bsc#1209211).
- CVE-2023-27536: Fixed GSS delegation too eager connection reuse (bsc#1209212).
- CVE-2023-27538: Fixed SSH connection too eager reuse still (bsc#1209214).
- CVE-2022-43552: HTTP Proxy deny use-after-free (bsc#1206309).
- CVE-2023-23916: Fixed HTTP multi-header compression denial of service (bsc#1207992).
- Record
SUSE-SU-2023:2228-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2230-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2023-28320: Fixed siglongjmp race condition (bsc#1211231).
- CVE-2023-28321: Fixed IDN wildcard matching (bsc#1211232).
- CVE-2023-28322: Fixed POST-after-PUT confusion (bsc#1211233).
- Record
SUSE-SU-2023:2230-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlAlpine:v3.15 |
before 8.1.0-r0 | 8.1.0-r0 |
curlAlpine:v3.16 |
before 8.1.0-r0 | 8.1.0-r0 |
curlAlpine:v3.17 |
before 8.1.0-r0 | 8.1.0-r0 |
curlAlpine:v3.18 |
before 8.1.0-r0 | 8.1.0-r0 |
curlAlpine:v3.19 |
before 8.1.0-r0 | 8.1.0-r0 |
curlAlpine:v3.20 |
before 8.1.0-r0 | 8.1.0-r0 |
curlAlpine:v3.21 |
before 8.1.0-r0 | 8.1.0-r0 |
curlAlpine:v3.22 |
before 8.1.0-r0 | 8.1.0-r0 |
curlAlpine:v3.23 |
before 8.1.0-r0 | 8.1.0-r0 |
curlAlpine:v3.24 |
before 8.1.0-r0 | 8.1.0-r0 |
Show 47 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cmakeAzure Linux:2 |
before 3.21.4-11 | 3.21.4-11 |
curlAzure Linux:2 |
before 8.2.1-1 | 8.2.1-1 |
mysqlAzure Linux:2 |
before 8.0.34-1 | 8.0.34-1 |
rustAzure Linux:2 |
before 1.72.0-2 | 1.72.0-2 |
cmakeAzure Linux:3 |
before 3.28.2-1 | 3.28.2-1 |
tensorflowAzure Linux:3 |
before 2.16.1-1 | 2.16.1-1 |
curlDebian:12 |
before 7.88.1-10 | 7.88.1-10 |
curlDebian:13 |
before 7.88.1-10 | 7.88.1-10 |
curlDebian:14 |
before 7.88.1-10 | 7.88.1-10 |
CURL_jllJulia |
before 8.5.0+0 | 8.5.0+0 |
LibCURL_jllJulia |
before 8.2.1+0 | 8.2.1+0 |
curlMageia:8 From an advisory covering 11 CVEs |
before 7.74.0-1.13.mga8 | 7.74.0-1.13.mga8 |
curlMageia:9 From an advisory covering 11 CVEs |
before 7.88.1-3.1.mga9 | 7.88.1-3.1.mga9 |
curlSUSE:Linux Enterprise Micro 5.3 From an advisory covering 4 CVEs |
before 8.0.1-150400.5.23.1 | 8.0.1-150400.5.23.1 |
curlSUSE:Linux Enterprise Micro 5.4 From an advisory covering 4 CVEs |
before 8.0.1-150400.5.23.1 | 8.0.1-150400.5.23.1 |
curlSUSE:Linux Enterprise Module for Basesystem 15 SP4 From an advisory covering 4 CVEs |
before 8.0.1-150400.5.23.1 | 8.0.1-150400.5.23.1 |
curlopenSUSE:Leap Micro 5.3 From an advisory covering 4 CVEs |
before 8.0.1-150400.5.23.1 | 8.0.1-150400.5.23.1 |
curlopenSUSE:Leap 15.4 From an advisory covering 4 CVEs |
before 8.0.1-150400.5.23.1 | 8.0.1-150400.5.23.1 |
curlopenSUSE:Leap 15.5 From an advisory covering 4 CVEs |
before 8.0.1-150400.5.23.1 | 8.0.1-150400.5.23.1 |
curlSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 5 CVEs |
before 8.0.1-11.65.2 | 8.0.1-11.65.2 |
curlSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 5 CVEs |
before 8.0.1-11.65.2 | 8.0.1-11.65.2 |
curlSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 5 CVEs |
before 8.0.1-11.65.2 | 8.0.1-11.65.2 |
curlSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 10 CVEs |
before 7.60.0-150000.51.1 | 7.60.0-150000.51.1 |
curlSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 10 CVEs |
before 7.60.0-150000.51.1 | 7.60.0-150000.51.1 |
curlSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 10 CVEs |
before 7.60.0-150000.51.1 | 7.60.0-150000.51.1 |
curlSUSE:Enterprise Storage 6 From an advisory covering 10 CVEs |
before 7.60.0-150000.51.1 | 7.60.0-150000.51.1 |
curlSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 3 CVEs |
before 7.66.0-150200.4.57.1 | 7.66.0-150200.4.57.1 |
curlSUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS From an advisory covering 3 CVEs |
before 7.66.0-150200.4.57.1 | 7.66.0-150200.4.57.1 |
curlSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 3 CVEs |
before 7.66.0-150200.4.57.1 | 7.66.0-150200.4.57.1 |
curlSUSE:Linux Enterprise Real Time 15 SP3 From an advisory covering 3 CVEs |
before 7.66.0-150200.4.57.1 | 7.66.0-150200.4.57.1 |
curlSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 3 CVEs |
before 7.66.0-150200.4.57.1 | 7.66.0-150200.4.57.1 |
curlSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 3 CVEs |
before 7.66.0-150200.4.57.1 | 7.66.0-150200.4.57.1 |
curlSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 3 CVEs |
before 7.66.0-150200.4.57.1 | 7.66.0-150200.4.57.1 |
curlSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 3 CVEs |
before 7.66.0-150200.4.57.1 | 7.66.0-150200.4.57.1 |
curlSUSE:Manager Proxy 4.2 From an advisory covering 3 CVEs |
before 7.66.0-150200.4.57.1 | 7.66.0-150200.4.57.1 |
curlSUSE:Manager Server 4.2 From an advisory covering 3 CVEs |
before 7.66.0-150200.4.57.1 | 7.66.0-150200.4.57.1 |
curlSUSE:Linux Enterprise Micro 5.1 From an advisory covering 3 CVEs |
before 7.66.0-150200.4.57.1 | 7.66.0-150200.4.57.1 |
curlSUSE:Linux Enterprise Micro 5.2 From an advisory covering 3 CVEs |
before 7.66.0-150200.4.57.1 | 7.66.0-150200.4.57.1 |
curlSUSE:Enterprise Storage 7 From an advisory covering 3 CVEs |
before 7.66.0-150200.4.57.1 | 7.66.0-150200.4.57.1 |
curlSUSE:Enterprise Storage 7.1 From an advisory covering 3 CVEs |
before 7.66.0-150200.4.57.1 | 7.66.0-150200.4.57.1 |
curlSUSE:OpenStack Cloud 9 From an advisory covering 10 CVEs |
before 7.60.0-4.56.1 | 7.60.0-4.56.1 |
curlSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 10 CVEs |
before 7.60.0-4.56.1 | 7.60.0-4.56.1 |
curlSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 10 CVEs |
before 7.60.0-4.56.1 | 7.60.0-4.56.1 |
curlSUSE:Linux Enterprise Server 12 SP4-ESPOS From an advisory covering 10 CVEs |
before 7.60.0-4.56.1 | 7.60.0-4.56.1 |
curlSUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 10 CVEs |
before 7.60.0-4.56.1 | 7.60.0-4.56.1 |
curlSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 3 CVEs |
before 7.37.0-37.98.1 | 7.37.0-37.98.1 |
curlopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 8.1.0-1.1 | 8.1.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-28320 is a medium vulnerability (CVSS 5.9) in Haxx Curl, published May 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.66%, the 85th percentile. Fixed in curl 8.1.0-r0.
References
hackerone.com/reports/1929597
security.netapp.com/advisory/ntap-20230609-0009
support.apple.com/kb/HT213843
support.apple.com/kb/HT213844
support.apple.com/kb/HT213845
seclists.org/fulldisclosure/2023/Jul/52
Show 58 moreShow less
seclists.org/fulldisclosure/2023/Jul/48
seclists.org/fulldisclosure/2023/Jul/47
security.gentoo.org/glsa/202310-12
nvd.nist.gov/vuln/detail/CVE-2023-28320
github.com/advisories/GHSA-c8wj-435x-f2cc
security.alpinelinux.org/vuln/CVE-2023-28320
docs.bell-sw.com/security/cves/CVE-2023-28320
github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28320.json
security-tracker.debian.org/tracker/CVE-2023-28320
advisories.mageia.org/MGASA-2023-0263.html
bugs.mageia.org/show_bug.cgi?id=31703
curl.se/docs/CVE-2023-27533.html
curl.se/docs/CVE-2023-27534.html
curl.se/docs/CVE-2023-27535.html
curl.se/docs/CVE-2023-27536.html
curl.se/docs/CVE-2023-27537.html
curl.se/docs/CVE-2023-27538.html
ubuntu.com/security/notices/USN-5964-1
curl.se/docs/CVE-2023-28319.html
curl.se/docs/CVE-2023-28320.html
curl.se/docs/CVE-2023-28321.html
curl.se/docs/CVE-2023-28322.html
lists.suse.com/pipermail/sle-security-updates/2023-May/014913.html
curl.se/docs/CVE-2023-32001.html
curl.se/docs/CVE-2023-38039.html
ubuntu.com/security/notices/USN-6363-1
suse.com/support/update/announcement/2023/suse-su-20232224-1
bugzilla.suse.com/1211230
bugzilla.suse.com/1211231
bugzilla.suse.com/1211232
bugzilla.suse.com/1211233
suse.com/security/cve/CVE-2023-28319
suse.com/security/cve/CVE-2023-28320
suse.com/security/cve/CVE-2023-28321
suse.com/security/cve/CVE-2023-28322
suse.com/support/update/announcement/2023/suse-su-20232224-2
suse.com/support/update/announcement/2023/suse-su-20232225-1
bugzilla.suse.com/1198608
suse.com/security/cve/CVE-2022-27774
suse.com/support/update/announcement/2023/suse-su-20232226-1
bugzilla.suse.com/1206309
bugzilla.suse.com/1207992
bugzilla.suse.com/1209209
bugzilla.suse.com/1209210
bugzilla.suse.com/1209211
bugzilla.suse.com/1209212
bugzilla.suse.com/1209214
bugzilla.suse.com/1211339
suse.com/security/cve/CVE-2022-43552
suse.com/security/cve/CVE-2023-23916
suse.com/security/cve/CVE-2023-27533
suse.com/security/cve/CVE-2023-27534
suse.com/security/cve/CVE-2023-27535
suse.com/security/cve/CVE-2023-27536
suse.com/security/cve/CVE-2023-27538
suse.com/support/update/announcement/2023/suse-su-20232227-1
suse.com/support/update/announcement/2023/suse-su-20232228-1
suse.com/support/update/announcement/2023/suse-su-20232230-1