GHSA-3vpc-4p9p-47hc
curl_cffi bundles a version of libcurl affected by High Severity vulnerability
Summary
curl_cffi is potentially affected by High Severity vulnerability (CVE-2023-38545) in libcurl<8.4.0
Details
HIGH severity vulnerability in curl and libcurl: announcement Details are still unknown, but seems it will be a major issue as it's advertised by curl devs as "probably the worst curl security flaw in a long time". A patched version (8.4.0) and details will be published around 06:00 UTC on October 11. curl_cffi wheels on PyPI ship with libcurl 7.84.0
PoC
Resolution
Versions after 0.7 bundles with libcurl>=8.5, which is not affected by this issue.
What each source reports
GitHub AdvisoriesNo score
curl_cffi bundles a version of libcurl affected by High Severity vulnerability
Summary
curl_cffi is potentially affected by High Severity vulnerability (CVE-2023-38545) in libcurl<8.4.0
Details
HIGH severity vulnerability in curl and libcurl: announcement Details are still unknown, but seems it will be a major issue as it's advertised by curl devs as "probably the worst curl security flaw in a long time". A patched version (8.4.0) and details will be published around 06:00 UTC on October 11. curl_cffi wheels on PyPI ship with libcurl 7.84.0
PoC
Resolution
Versions after 0.7 bundles with libcurl>=8.5, which is not affected by this issue.
- Record
GHSA-3vpc-4p9p-47hc- Weakness
- CWE-1395
- Updated
- 2026-11-02
OSVNo score
curl_cffi bundles a version of libcurl affected by High Severity vulnerability
Summary
curl_cffi is potentially affected by High Severity vulnerability (CVE-2023-38545) in libcurl<8.4.0
Details
HIGH severity vulnerability in curl and libcurl: announcement Details are still unknown, but seems it will be a major issue as it's advertised by curl devs as "probably the worst curl security flaw in a long time". A patched version (8.4.0) and details will be published around 06:00 UTC on October 11. curl_cffi wheels on PyPI ship with libcurl 7.84.0
PoC
Resolution
Versions after 0.7 bundles with libcurl>=8.5, which is not affected by this issue.
- Record
GHSA-3vpc-4p9p-47hc- Weakness
- CWE-1395
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curl-cffiPyPI | through 0.6.4 | 0.7.0b6 |
curl-cffiPyPI | before 0.7.0b6, plus listed versions 0.1.50.2.00.2.10.2.40.2.5 Show 38 moreShow less0.3.00.3.10.3.20.3.70.3.80.4.00.5.00.5.10.5.100.5.10b10.5.10b20.5.10b30.5.10b40.5.10b50.5.20.5.30.5.40.5.50.5.60.5.70.5.90.5.9b10.5.9b20.5.9b30.5.9b40.5.9b50.5.9b60.6.00.6.0b20.6.0b40.6.0b70.6.0b90.6.10.6.20.6.30.6.3b10.6.40.7.0b4 | 0.7.0b6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-3vpc-4p9p-47hc is a vulnerability with no CVSS score yet in curl-cffi, published October 22, 2024. No source lists public exploit code. Fixed in curl-cffi 0.7.0b6.