{"id":"CVE-2023-27537","aliases":["ALPINE-CVE-2023-27537","AZL-25852","AZL-25858","AZL-34603","AZL-38114","BELL-CVE-2023-27537","CURL-CVE-2023-27537","DEBIAN-CVE-2023-27537","EUVD-2023-31292","GHSA-9j2c-vm53-wcvm","JLSEC-2025-32","MGASA-2023-0263","openSUSE-SU-2024:12812-1"],"status":"published","title":"A double free vulnerability exists in libcurl \u003c8.0.0 when sharing HSTS data between separate ...","description":"A double free vulnerability exists in libcurl \u003c8.0.0 when sharing HSTS data between separate \"handles\". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01898,"percentile":0.7995,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2023-03-20T08:00:00Z","modified":"2026-11-04T02:30:58Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"curl","fixed_in":["8.0.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"curl","fixed_in":["8.0.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"curl","fixed_in":["8.0.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["7.88.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["8.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["8.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["8.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["8.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["8.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.0.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"mysql","fixed_in":["8.0.33-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"rust","fixed_in":["1.72.0-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cmake","fixed_in":["3.28.2-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"tensorflow","fixed_in":["2.16.1-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.88.1-7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.88.1-7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.88.1-7"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.0.1+0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.33-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.72.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.2-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"tensorflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-7"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-7"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-7"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"7.88.1+0"},{"fixed":"8.0.1+0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.13.mga8"}]}],"bundled":11},{"source":"osv","ecosystem":"Mageia:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-3.1.mga9"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-1.1"}]}],"bundled":6}],"products":[{"vendor":"broadcom","product":"brocade_fabric_operating_system_firmware"},{"vendor":"haxx","product":"libcurl"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"splunk","product":"universal_forwarder"}],"references":[{"url":"https://hackerone.com/reports/1897203","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230420-0010/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202310-12","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-943925.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27537","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230420-0010"},{"url":"https://github.com/advisories/GHSA-9j2c-vm53-wcvm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-27537","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-27537","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27537.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-27537","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0263.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31703","tags":["report"]},{"url":"https://curl.se/docs/CVE-2023-27533.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-27534.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-27535.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-27536.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-27537.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-27538.html","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5964-1","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-28319.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-28320.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-28321.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-28322.html","tags":["advisory"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2023-May/014913.html","tags":["web"]},{"url":"https://curl.se/docs/CVE-2023-32001.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-38039.html","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6363-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27538","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-27537","description":"A double free vulnerability exists in libcurl \u003c8.0.0 when sharing HSTS data between separate \"handles\". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.","status":"published","published":"2023-03-30T00:00:00Z","modified":"2026-11-02T22:32:10.949Z","cwes":["CWE-415"],"updated_at":"2026-11-03T00:01:30.510858Z"}],"euvd":[{"id":"EUVD-2023-31292","description":"A double free vulnerability exists in libcurl \u003c8.0.0 when sharing HSTS data between separate \"handles\". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.","status":"published","published":"2023-03-30T00:00:00Z","modified":"2026-11-02T22:32:10Z","updated_at":"2026-11-03T05:08:36.239358Z"}],"ghsa":[{"id":"GHSA-9j2c-vm53-wcvm","title":"A double free vulnerability exists in libcurl \u003c8.0.0 when sharing HSTS data between separate ...","description":"A double free vulnerability exists in libcurl \u003c8.0.0 when sharing HSTS data between separate \"handles\". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.","status":"published","published":"2023-03-30T21:30:21Z","modified":"2026-10-15T00:30:38Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T15:13:29.914076Z"}],"nvd":[{"id":"CVE-2023-27537","description":"A double free vulnerability exists in libcurl \u003c8.0.0 when sharing HSTS data between separate \"handles\". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.","status":"published","published":"2023-03-30T20:15:07.617Z","modified":"2026-11-02T23:17:15.623Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-415"],"updated_at":"2026-11-03T06:40:49.610767Z"}],"osv":[{"id":"ALPINE-CVE-2023-27537","description":"A double free vulnerability exists in libcurl \u003c8.0.0 when sharing HSTS data between separate \"handles\". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.","status":"published","published":"2023-03-30T20:15:07.617Z","modified":"2026-10-26T17:17:58.616035208Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:49.202584Z"},{"id":"AZL-25852","title":"CVE-2023-27537 affecting package mysql for versions less than 8.0.33-1","description":"A double free vulnerability exists in libcurl \u003c8.0.0 when sharing HSTS data between separate \"handles\". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.","status":"published","published":"2023-03-30T20:15:07Z","modified":"2026-04-21T04:23:19.31267Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-25858","title":"CVE-2023-27537 affecting package rust for versions less than 1.72.0-2","description":"A double free vulnerability exists in libcurl \u003c8.0.0 when sharing HSTS data between separate \"handles\". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.","status":"published","published":"2023-03-30T20:15:07Z","modified":"2026-04-21T04:23:20.794583Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-34603","title":"CVE-2023-27537 affecting package cmake for versions less than 3.28.2-1","description":"A double free vulnerability exists in libcurl \u003c8.0.0 when sharing HSTS data between separate \"handles\". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.","status":"published","published":"2023-03-30T20:15:07Z","modified":"2026-04-21T04:33:57.970294Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-38114","title":"CVE-2023-27537 affecting package tensorflow for versions less than 2.16.1-1","description":"A double free vulnerability exists in libcurl \u003c8.0.0 when sharing HSTS data between separate \"handles\". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.","status":"published","published":"2023-03-30T20:15:07Z","modified":"2026-04-21T04:47:43.813866Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"BELL-CVE-2023-27537","title":"CVE-2023-27537 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:24.772239Z","modified":"2026-01-26T09:50:11.147591Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"DEBIAN-CVE-2023-27537","description":"A double free vulnerability exists in libcurl \u003c8.0.0 when sharing HSTS data between separate \"handles\". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.","status":"published","published":"2023-03-30T20:15:07.617Z","modified":"2026-11-03T09:47:36.675010149Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T10:27:58.933618Z"},{"id":"JLSEC-2025-32","title":"A double free vulnerability exists in libcurl \u003c8.0.0 when sharing HSTS data between separate...","description":"A double free vulnerability exists in libcurl \u003c8.0.0 when sharing HSTS data between separate \"handles\". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.","status":"published","published":"2025-10-10T15:04:01.319Z","modified":"2026-07-25T18:23:40.406825414Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"CURL-CVE-2023-27537","title":"HSTS double free","description":"libcurl supports sharing HSTS data between separate \"handles\". This sharing\nwas introduced without considerations for doing this sharing across separate\nthreads but there was no indication of this fact in the documentation.\n\nDue to missing mutexes or thread locks, two threads sharing the same HSTS data\ncould end up doing a double free or use after free.","status":"published","published":"2023-03-20T08:00:00Z","modified":"2026-10-24T23:29:53Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"CVE-2023-27537","description":"A double free vulnerability exists in libcurl \u003c8.0.0 when sharing HSTS data between separate \"handles\". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.","status":"published","published":"2023-03-30T00:00:00Z","modified":"2026-11-04T02:30:58.563059249Z","cwes":["CWE-415"],"updated_at":"2026-11-04T02:54:44.889498Z"},{"id":"MGASA-2023-0263","title":"Updated curl packages fix security vulnerability","description":"TELNET option IAC injection. (CVE-2023-27533)\n\nSFTP path ~ resolving discrepancy. (CVE-2023-27534)\n\nFTP too eager connection reuse. (CVE-2023-27535)\n\nGSS delegation too eager connection re-use. (CVE-2023-27536)\n\nHSTS double free. (CVE-2023-27537)\n\nSSH connection too eager reuse still. (CVE-2023-27538)\n\nUAF in SSH sha256 fingerprint check. (CVE-2023-28319)\n\nsiglongjmp race condition. (CVE-2023-28320)\n\nIDN wildcard match. (CVE-2023-28321)\n\nmore POST-after-PUT confusion. (CVE-2023-28322)\n\nHTTP headers eat all memory. (CVE-2023-38039)\n","status":"published","published":"2023-09-24T22:16:18Z","modified":"2026-04-16T04:43:47.858393758Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12812-1","title":"curl-8.0.1-1.1 on GA media","description":"These are all security issues fixed in the curl-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:14:39.607641Z","updated_at":"2026-11-02T16:58:35.751245Z"}]}}