{"id":"CVE-2023-23914","aliases":["ALPINE-CVE-2023-23914","AZL-13650","AZL-13654","AZL-34615","AZL-38043","BELL-CVE-2023-23914","CURL-CVE-2023-23914","DEBIAN-CVE-2023-23914","EUVD-2023-27996","GHSA-75qm-2q4j-qx6g","JLSEC-2026-402","OESA-2023-1124","OESA-2023-1125","RHSA-2023:3354","ROOT-OS-DEBIAN-11-CVE-2023-23914","SUSE-SU-2023:0429-1","UBUNTU-CVE-2023-23914","USN-5891-1","openSUSE-SU-2024:12735-1"],"status":"published","title":"A cleartext transmission of sensitive information vulnerability exists in curl \u003cv7.88.0 that...","description":"A cleartext transmission of sensitive information vulnerability exists in curl \u003cv7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00902,"percentile":0.59988,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-319"],"published":"2023-02-15T00:00:00Z","modified":"2026-10-28T02:30:35Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"curl","fixed_in":["7.79.1-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"curl","fixed_in":["7.80.0-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"curl","fixed_in":["7.83.1-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["7.87.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["7.88.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["7.88.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["7.88.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["7.88.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["7.88.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["7.88.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["7.88.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"cmake","fixed_in":["3.21.4-6"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"curl","fixed_in":["7.88.1-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cmake","fixed_in":["3.21.4-10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"tensorflow","fixed_in":["2.16.1-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.88.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.88.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.88.1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.5.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["7.88.1+0"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"curl","fixed_in":["7.74.0-1.3+deb11u16.root.io.13","7.74.0-1.3+deb11u16.aikido.18","7.74.0-1.3+deb11u16.aikido.19","7.74.0-1.3+deb11u16.root.io.17","7.74.0-1.3+deb11u16.root.io.15","7.74.0-1.3+deb11u16.root.io.16","7.74.0-1.3+deb11u16.root.io.14"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-curl","fixed_in":["7.74.0-1.3+deb11u16.root.io.13","7.74.0-1.3+deb11u16.aikido.18","7.74.0-1.3+deb11u16.aikido.19","7.74.0-1.3+deb11u16.root.io.17","7.74.0-1.3+deb11u16.root.io.15","7.74.0-1.3+deb11u16.root.io.16","7.74.0-1.3+deb11u16.root.io.14"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"curl","fixed_in":["7.81.0-1ubuntu1.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.77.0"},{"fixed":"7.79.1-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.77.0"},{"fixed":"7.80.0-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.77.0"},{"fixed":"7.83.1-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.77.0"},{"fixed":"7.87.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.77.0"},{"fixed":"7.88.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.77.0"},{"fixed":"7.88.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.77.0"},{"fixed":"7.88.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.77.0"},{"fixed":"7.88.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.77.0"},{"fixed":"7.88.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.77.0"},{"fixed":"7.88.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.77.0"},{"fixed":"7.88.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.4-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.4-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"tensorflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.5.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"7.81.0+0"},{"fixed":"7.88.1+0"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-14.oe2203"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-14.oe2203sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-39.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-39.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-39.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-odbc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-101.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-1.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-1.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-1.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-1.el7jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-1.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-1.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-1.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-1.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-1.el8jbcs"}]}],"bundled":14},{"source":"osv","ecosystem":"Root:Debian:11","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.3+deb11u16.root.io.13"},{"fixed":"7.74.0-1.3+deb11u16.aikido.18"},{"fixed":"7.74.0-1.3+deb11u16.aikido.19"},{"fixed":"7.74.0-1.3+deb11u16.root.io.17"},{"fixed":"7.74.0-1.3+deb11u16.root.io.15"},{"fixed":"7.74.0-1.3+deb11u16.root.io.16"},{"fixed":"7.74.0-1.3+deb11u16.root.io.14"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.3+deb11u16.root.io.13"},{"fixed":"7.74.0-1.3+deb11u16.aikido.18"},{"fixed":"7.74.0-1.3+deb11u16.aikido.19"},{"fixed":"7.74.0-1.3+deb11u16.root.io.17"},{"fixed":"7.74.0-1.3+deb11u16.root.io.15"},{"fixed":"7.74.0-1.3+deb11u16.root.io.16"},{"fixed":"7.74.0-1.3+deb11u16.root.io.14"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-150400.5.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-150400.5.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-150400.5.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-150400.5.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81.0-1ubuntu1.8"}]}],"versions":["7.74.0-1.3ubuntu2","7.74.0-1.3ubuntu3","7.80.0-3","7.81.0-1","7.81.0-1ubuntu1.1","7.81.0-1ubuntu1.2","7.81.0-1ubuntu1.3","7.81.0-1ubuntu1.4","7.81.0-1ubuntu1.6","7.81.0-1ubuntu1.7"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.23"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10","7.58.0-2ubuntu3.12","7.58.0-2ubuntu3.13","7.58.0-2ubuntu3.14","7.58.0-2ubuntu3.15","7.58.0-2ubuntu3.16","7.58.0-2ubuntu3.17","7.58.0-2ubuntu3.18","7.58.0-2ubuntu3.19","7.58.0-2ubuntu3.20","7.58.0-2ubuntu3.21","7.58.0-2ubuntu3.22"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.16"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4","7.68.0-1ubuntu2.5","7.68.0-1ubuntu2.6","7.68.0-1ubuntu2.7","7.68.0-1ubuntu2.10","7.68.0-1ubuntu2.11","7.68.0-1ubuntu2.12","7.68.0-1ubuntu2.13","7.68.0-1ubuntu2.14","7.68.0-1ubuntu2.15"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81.0-1ubuntu1.8"}]}],"versions":["7.74.0-1.3ubuntu2","7.74.0-1.3ubuntu3","7.80.0-3","7.81.0-1","7.81.0-1ubuntu1.1","7.81.0-1ubuntu1.2","7.81.0-1ubuntu1.3","7.81.0-1ubuntu1.4","7.81.0-1ubuntu1.6","7.81.0-1ubuntu1.7"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-1.1"}]}],"bundled":3}],"products":[{"vendor":"haxx","product":"curl"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"splunk","product":"universal_forwarder"}],"references":[{"url":"https://hackerone.com/reports/1813864","tags":["x_transferred","Exploit","Issue Tracking","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230309-0006/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202310-12","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23914","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-75qm-2q4j-qx6g"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-23914","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-23914","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23914.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-23914","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1124","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23915","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23916","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1125","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3354","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2152639","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2152652","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2161774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164440","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164487","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164492","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164494","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167797","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167813","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2169652","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2176209","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179062","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179069","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3354.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2006-20001","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-20001","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-20001","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2006-20001","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-4304","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4304","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20230207.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-4450","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4450","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4450","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25147","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25147","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25147","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43551","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43551","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43551","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2022-43551.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43552","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43552","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43552","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2022-43552.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0215","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0215","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0215","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0286","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0286","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23914","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23914","tags":["advisory","report"]},{"url":"https://curl.se/docs/CVE-2023-23914.html","tags":["article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23915","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23915","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-23915.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23916","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23916","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-23916.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25690","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25690","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25690","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27533","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27533","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27533","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-27533.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27534","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27534","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27534","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-27534.html","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230429-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1207990","tags":["report"]},{"url":"https://bugzilla.suse.com/1207991","tags":["report"]},{"url":"https://bugzilla.suse.com/1207992","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23916","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-23914","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5891-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-23915","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-23916","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-23914","description":"A cleartext transmission of sensitive information vulnerability exists in curl \u003cv7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.","status":"published","published":"2023-02-23T00:00:00Z","modified":"2026-10-14T22:31:57.878Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-319","CWE-319"],"updated_at":"2026-11-02T14:35:20.812737Z"}],"euvd":[{"id":"EUVD-2023-27996","description":"A cleartext transmission of sensitive information vulnerability exists in curl \u003cv7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.","status":"published","published":"2023-02-23T00:00:00Z","modified":"2026-10-14T22:31:57Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T17:27:11.707191Z"}],"ghsa":[{"id":"GHSA-75qm-2q4j-qx6g","title":"A cleartext transmission of sensitive information vulnerability exists in curl \u003cv7.88.0 that...","description":"A cleartext transmission of sensitive information vulnerability exists in curl \u003cv7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.","status":"published","published":"2023-02-23T21:30:16Z","modified":"2023-02-23T21:30:23Z","updated_at":"2026-11-02T14:54:13.537745Z"}],"nvd":[{"id":"CVE-2023-23914","description":"A cleartext transmission of sensitive information vulnerability exists in curl \u003cv7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.","status":"published","published":"2023-02-23T20:15:13.637Z","modified":"2026-10-14T23:17:14.05Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:07:47.623983Z"}],"osv":[{"id":"ALPINE-CVE-2023-23914","description":"A cleartext transmission of sensitive information vulnerability exists in curl \u003cv7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.","status":"published","published":"2023-02-23T20:15:13.637Z","modified":"2026-10-26T17:17:58.608791214Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:27:49.202584Z"},{"id":"AZL-13650","title":"CVE-2023-23914 affecting package cmake for versions less than 3.21.4-6","description":"A cleartext transmission of sensitive information vulnerability exists in curl \u003cv7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.","status":"published","published":"2023-02-23T20:15:13Z","modified":"2026-04-21T04:17:43.111636Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-13654","title":"CVE-2023-23914 affecting package curl for versions less than 7.88.1-1","description":"A cleartext transmission of sensitive information vulnerability exists in curl \u003cv7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.","status":"published","published":"2023-02-23T20:15:13Z","modified":"2026-04-21T04:21:31.602516Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-34615","title":"CVE-2023-23914 affecting package cmake for versions less than 3.21.4-10","description":"A cleartext transmission of sensitive information vulnerability exists in curl \u003cv7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.","status":"published","published":"2023-02-23T20:15:13Z","modified":"2026-04-21T04:33:38.063716Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-38043","title":"CVE-2023-23914 affecting package tensorflow for versions less than 2.16.1-1","description":"A cleartext transmission of sensitive information vulnerability exists in curl \u003cv7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.","status":"published","published":"2023-02-23T20:15:13Z","modified":"2026-04-21T04:52:21.367906Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"BELL-CVE-2023-23914","title":"CVE-2023-23914 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:33.19013Z","modified":"2026-01-26T09:47:08.423082Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-23914","description":"A cleartext transmission of sensitive information vulnerability exists in curl \u003cv7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.","status":"published","published":"2023-02-23T00:00:00Z","modified":"2026-10-28T02:30:35.492711514Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"DEBIAN-CVE-2023-23914","description":"A cleartext transmission of sensitive information vulnerability exists in curl \u003cv7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.","status":"published","published":"2023-02-23T20:15:13.637Z","modified":"2026-10-26T18:02:23.069306057Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"JLSEC-2026-402","description":"A cleartext transmission of sensitive information vulnerability exists in curl \u003cv7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.","status":"published","published":"2026-05-04T13:12:06.605Z","modified":"2026-07-18T00:01:56.098160046Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2023-1124","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the Curl package, where the HSTS mechanism could fail when multiple transfers are done in parallel, as the HSTS cache file gets overwritten by the most recently completed transfer. This issue may result in limited confidentiality and integrity.(CVE-2023-23915)\r\n\r\nA flaw was found in the Curl package, where the HSTS mechanism would be ignored by subsequent transfers when done on the same command line because the state would not be properly carried. This issue may result in limited confidentiality and integrity.(CVE-2023-23914)\r\n\r\ncurl supports \u0026quot;chained\u0026quot; HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with different algorithms. The number of acceptable \u0026quot;links\u0026quot; in this \u0026quot;decompression chain\u0026quot; was capped, but the cap was implemented on a per-header basis allowing a malicious server to insert a virtually unlimited number of compression steps simply by using many headers. The use of such a decompression chain could result in a \u0026quot;malloc bomb\u0026quot;, making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.(CVE-2023-23916)","status":"published","published":"2023-02-24T11:05:35Z","modified":"2026-08-18T01:17:31.560290601Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2023-1125","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the Curl package, where the HSTS mechanism could fail when multiple transfers are done in parallel, as the HSTS cache file gets overwritten by the most recently completed transfer. This issue may result in limited confidentiality and integrity.(CVE-2023-23915)\r\n\r\nA flaw was found in the Curl package, where the HSTS mechanism would be ignored by subsequent transfers when done on the same command line because the state would not be properly carried. This issue may result in limited confidentiality and integrity.(CVE-2023-23914)\r\n\r\ncurl supports \u0026quot;chained\u0026quot; HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with different algorithms. The number of acceptable \u0026quot;links\u0026quot; in this \u0026quot;decompression chain\u0026quot; was capped, but the cap was implemented on a per-header basis allowing a malicious server to insert a virtually unlimited number of compression steps simply by using many headers. The use of such a decompression chain could result in a \u0026quot;malloc bomb\u0026quot;, making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.(CVE-2023-23916)","status":"published","published":"2023-02-24T11:05:36Z","modified":"2026-08-18T01:17:31.547227041Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2023:3354","title":"Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP2 security update","status":"published","published":"2024-09-14T00:03:54Z","modified":"2026-10-15T10:04:16Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2023-23914","title":"CVE-2023-23914 in curl - Patched by Root","description":"Root has patched CVE-2023-23914 in the curl package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-20T12:49:54Z","modified":"2026-08-20T13:30:11.482122981Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:28.80888Z"},{"id":"UBUNTU-CVE-2023-23914","description":"A cleartext transmission of sensitive information vulnerability exists in curl \u003cv7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.","status":"published","published":"2023-02-15T00:00:00Z","modified":"2026-04-22T14:03:13.019222Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"CURL-CVE-2023-23914","title":"HSTS ignored on multiple requests","description":"curl's HSTS functionality fail when multiple URLs are requested serially.\n\nUsing its HSTS support, curl can be instructed to use HTTPS instead of using\nan insecure clear-text HTTP step even when HTTP is provided in the URL. This\nHSTS mechanism would however surprisingly be ignored by subsequent transfers\nwhen done on the same command line because the state would not be properly\ncarried on.\n\nReproducible like this:\n\n    curl --hsts \"\" https://curl.se http://curl.se\n\nThe first URL returns HSTS information that the second URL fails to take\nadvantage of.","status":"published","published":"2023-02-15T08:00:00Z","modified":"2026-10-27T01:28:35.456219107Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"openSUSE-SU-2024:12735-1","title":"curl-7.88.1-1.1 on GA media","description":"These are all security issues fixed in the curl-7.88.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:14:42.784933Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2023:0429-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2023-23914: Fixed HSTS ignored on multiple requests (bsc#1207990).\n- CVE-2023-23915: Fixed HSTS amnesia with --parallel (bsc#1207991).\n- CVE-2023-23916: Fixed HTTP multi-header compression denial of service (bsc#1207992).\n","status":"published","published":"2023-02-15T16:41:28Z","modified":"2026-02-04T04:24:34.229813Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"USN-5891-1","title":"curl vulnerabilities","description":"Harry Sintonen discovered that curl incorrectly handled HSTS support\nwhen multiple URLs are requested serially. A remote attacker could possibly\nuse this issue to cause curl to use unencrypted connections. This issue\nonly affected Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2023-23914)\n\nHarry Sintonen discovered that curl incorrectly handled HSTS support\nwhen multiple URLs are requested in parallel. A remote attacker could\npossibly use this issue to cause curl to use unencrypted connections. This\nissue only affected Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2023-23915)\n\nPatrick Monnerat discovered that curl incorrectly handled memory when\nprocessing requests with multi-header compression. A remote attacker could\npossibly use this issue to cause curl to consume resources, leading to a\ndenial of service. (CVE-2023-23916)\n","status":"published","published":"2023-02-27T12:34:20Z","modified":"2026-04-22T10:32:35.342708Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}