{"id":"CVE-2023-28320","aliases":["ALPINE-CVE-2023-28320","AZL-26790","AZL-26793","AZL-26809","AZL-26813","AZL-34605","AZL-38926","BELL-CVE-2023-28320","CURL-CVE-2023-28320","DEBIAN-CVE-2023-28320","EUVD-2023-32027","GHSA-c8wj-435x-f2cc","JLSEC-2026-408","MGASA-2023-0263","SUSE-SU-2023:2224-1","SUSE-SU-2023:2224-2","SUSE-SU-2023:2225-1","SUSE-SU-2023:2226-1","SUSE-SU-2023:2227-1","SUSE-SU-2023:2228-1","SUSE-SU-2023:2230-1","openSUSE-SU-2024:12940-1"],"status":"published","title":"A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several...","description":"A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02658,"percentile":0.8578,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362","CWE-400"],"published":"2023-05-17T07:54:03Z","modified":"2026-10-28T02:30:48Z","fixes":[{"ecosystem":"Alpine:v3.15","package":"curl","fixed_in":["8.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"curl","fixed_in":["8.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["8.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["8.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["8.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["8.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["8.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["8.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.1.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"cmake","fixed_in":["3.21.4-11"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"curl","fixed_in":["8.2.1-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"mysql","fixed_in":["8.0.34-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"rust","fixed_in":["1.72.0-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cmake","fixed_in":["3.28.2-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"tensorflow","fixed_in":["2.16.1-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.88.1-10"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.88.1-10"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.88.1-10"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.5.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.2.1+0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.4-11"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.34-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.72.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.2-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"tensorflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10"}]}]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.5.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.2.1+0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.13.mga8"}]}],"bundled":11},{"source":"osv","ecosystem":"Mageia:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-3.1.mga9"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.65.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.65.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.65.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-150000.51.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-150000.51.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-150000.51.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-150000.51.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.56.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.56.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.56.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.56.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.56.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.98.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.0-1.1"}]}],"bundled":4}],"products":[{"vendor":"apple","product":"macos"},{"vendor":"haxx","product":"curl"},{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"netapp","product":"ontap_antivirus_connector"}],"references":[{"url":"https://hackerone.com/reports/1929597","tags":["x_transferred","Exploit","Patch","Third Party Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230609-0009/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://support.apple.com/kb/HT213843","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://support.apple.com/kb/HT213844","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://support.apple.com/kb/HT213845","tags":["x_transferred","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2023/Jul/52","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"http://seclists.org/fulldisclosure/2023/Jul/48","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"http://seclists.org/fulldisclosure/2023/Jul/47","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://security.gentoo.org/glsa/202310-12","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28320","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230609-0009"},{"url":"https://github.com/advisories/GHSA-c8wj-435x-f2cc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-28320","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-28320","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28320.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-28320","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0263.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31703","tags":["report"]},{"url":"https://curl.se/docs/CVE-2023-27533.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-27534.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-27535.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-27536.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-27537.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-27538.html","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5964-1","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-28319.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-28320.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-28321.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-28322.html","tags":["advisory"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2023-May/014913.html","tags":["web"]},{"url":"https://curl.se/docs/CVE-2023-32001.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-38039.html","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6363-1","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232224-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1211230","tags":["report"]},{"url":"https://bugzilla.suse.com/1211231","tags":["report"]},{"url":"https://bugzilla.suse.com/1211232","tags":["report"]},{"url":"https://bugzilla.suse.com/1211233","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28322","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232224-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232225-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1198608","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27774","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232226-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1206309","tags":["report"]},{"url":"https://bugzilla.suse.com/1207992","tags":["report"]},{"url":"https://bugzilla.suse.com/1209209","tags":["report"]},{"url":"https://bugzilla.suse.com/1209210","tags":["report"]},{"url":"https://bugzilla.suse.com/1209211","tags":["report"]},{"url":"https://bugzilla.suse.com/1209212","tags":["report"]},{"url":"https://bugzilla.suse.com/1209214","tags":["report"]},{"url":"https://bugzilla.suse.com/1211339","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-43552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27538","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232227-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232228-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232230-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-28320","description":"A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.","status":"published","published":"2023-05-26T00:00:00Z","modified":"2025-01-15T15:59:07.016Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:35:32.752775Z"}],"euvd":[{"id":"EUVD-2023-32027","description":"A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.","status":"published","published":"2023-05-26T00:00:00Z","modified":"2025-01-15T15:59:07Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:04:19.010388Z"}],"ghsa":[{"id":"GHSA-c8wj-435x-f2cc","title":"A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several...","description":"A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.","status":"published","published":"2023-05-26T21:30:23Z","modified":"2024-04-04T04:21:33Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-362","CWE-400"],"updated_at":"2026-11-02T14:56:23.412856Z"}],"nvd":[{"id":"CVE-2023-28320","description":"A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.","status":"published","published":"2023-05-26T21:15:15.937Z","modified":"2026-10-23T23:10:00.157Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-400","CWE-362"],"updated_at":"2026-11-02T14:08:03.200773Z"}],"osv":[{"id":"ALPINE-CVE-2023-28320","description":"A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.","status":"published","published":"2023-05-26T21:15:15.937Z","modified":"2026-10-26T17:17:58.617871272Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:49.202584Z"},{"id":"AZL-26790","title":"CVE-2023-28320 affecting package cmake for versions less than 3.21.4-11","description":"A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.","status":"published","published":"2023-05-26T21:15:15Z","modified":"2026-04-21T04:23:51.000575Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-26793","title":"CVE-2023-28320 affecting package curl for versions less than 8.2.1-1","description":"A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.","status":"published","published":"2023-05-26T21:15:15Z","modified":"2026-04-21T04:23:51.881732Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-26809","title":"CVE-2023-28320 affecting package mysql for versions less than 8.0.34-1","description":"A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.","status":"published","published":"2023-05-26T21:15:15Z","modified":"2026-04-21T04:23:53.501906Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-26813","title":"CVE-2023-28320 affecting package rust for versions less than 1.72.0-2","description":"A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.","status":"published","published":"2023-05-26T21:15:15Z","modified":"2026-04-21T04:23:54.129013Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-34605","title":"CVE-2023-28320 affecting package cmake for versions less than 3.28.2-1","description":"A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.","status":"published","published":"2023-05-26T21:15:15Z","modified":"2026-04-21T04:33:55.571206Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-38926","title":"CVE-2023-28320 affecting package tensorflow for versions less than 2.16.1-1","description":"A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.","status":"published","published":"2023-05-26T21:15:15Z","modified":"2026-04-21T04:54:03.936972Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"BELL-CVE-2023-28320","title":"CVE-2023-28320 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:06.873837Z","modified":"2026-01-26T09:49:47.493441Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-28320","description":"A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.","status":"published","published":"2023-05-26T00:00:00Z","modified":"2026-10-28T02:30:48.734444424Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"DEBIAN-CVE-2023-28320","description":"A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.","status":"published","published":"2023-05-26T21:15:15.937Z","modified":"2026-10-24T09:47:36.637730685Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"JLSEC-2026-408","description":"A denial of service vulnerability exists in curl \u003cv8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.","status":"published","published":"2026-05-04T13:12:06.605Z","modified":"2026-07-18T00:01:56.984739049Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"CURL-CVE-2023-28320","title":"siglongjmp race condition","description":"libcurl provides several different backends for resolving hostnames, selected\nat build time. If it is built to use the synchronous resolver, it allows name\nresolves to time-out slow operations using `alarm()` and `siglongjmp()`.\n\nWhen doing this, libcurl used a global buffer that was not mutex protected and\na multi-threaded application might therefore crash or otherwise misbehave.","status":"published","published":"2023-05-17T08:00:00Z","modified":"2026-10-27T01:28:36.260008926Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"MGASA-2023-0263","title":"Updated curl packages fix security vulnerability","description":"TELNET option IAC injection. (CVE-2023-27533)\n\nSFTP path ~ resolving discrepancy. (CVE-2023-27534)\n\nFTP too eager connection reuse. (CVE-2023-27535)\n\nGSS delegation too eager connection re-use. (CVE-2023-27536)\n\nHSTS double free. (CVE-2023-27537)\n\nSSH connection too eager reuse still. (CVE-2023-27538)\n\nUAF in SSH sha256 fingerprint check. (CVE-2023-28319)\n\nsiglongjmp race condition. (CVE-2023-28320)\n\nIDN wildcard match. (CVE-2023-28321)\n\nmore POST-after-PUT confusion. (CVE-2023-28322)\n\nHTTP headers eat all memory. (CVE-2023-38039)\n","status":"published","published":"2023-09-24T22:16:18Z","modified":"2026-04-16T04:43:47.858393758Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12940-1","title":"curl-8.1.0-1.1 on GA media","description":"These are all security issues fixed in the curl-8.1.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:55:50.680151Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2023:2224-1","title":"Security update for curl","description":"This update for curl adds the following feature:\n\nUpdate to version 8.0.1 (jsc#PED-2580)\n\n- CVE-2023-28319: use-after-free in SSH sha256 fingerprint check (bsc#1211230).\n- CVE-2023-28320: siglongjmp race condition (bsc#1211231).\n- CVE-2023-28321: IDN wildcard matching (bsc#1211232).\n- CVE-2023-28322: POST-after-PUT confusion (bsc#1211233).\n","status":"published","published":"2023-05-17T07:54:03Z","modified":"2026-02-04T04:02:41.19369Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2224-2","title":"Security update for curl","description":"This update for curl adds the following feature:\n\nUpdate to version 8.0.1 (jsc#PED-2580)\n\n- CVE-2023-28319: use-after-free in SSH sha256 fingerprint check (bsc#1211230).\n- CVE-2023-28320: siglongjmp race condition (bsc#1211231).\n- CVE-2023-28321: IDN wildcard matching (bsc#1211232).\n- CVE-2023-28322: POST-after-PUT confusion (bsc#1211233).\n","status":"published","published":"2023-06-21T16:13:49Z","modified":"2026-02-04T02:27:41.840218Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2225-1","title":"Security update for curl","description":"This update for curl adds the following feature:\n\nUpdate to version 8.0.1 (jsc#PED-2580)\n\n- CVE-2023-28319: use-after-free in SSH sha256 fingerprint check (bsc#1211230).\n- CVE-2023-28320: siglongjmp race condition (bsc#1211231).\n- CVE-2023-28321: IDN wildcard matching (bsc#1211232).\n- CVE-2023-28322: POST-after-PUT confusion (bsc#1211233).\n","status":"published","published":"2023-05-17T07:55:09Z","modified":"2026-02-04T03:51:12.77153Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2226-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2023-28320: Fixed siglongjmp race condition (bsc#1211231).\n- CVE-2023-28321: Fixed IDN wildcard matching (bsc#1211232).\n- CVE-2023-28322: Fixed POST-after-PUT confusion (bsc#1211233).\n- CVE-2023-27533: Fixed TELNET option IAC injection (bsc#1209209).\n- CVE-2023-27534: Fixed SFTP path ~ resolving discrepancy (bsc#1209210).\n- CVE-2023-27535: Fixed FTP too eager connection reuse (bsc#1209211).\n- CVE-2023-27536: Fixed GSS delegation too eager connection reuse (bsc#1209212).\n- CVE-2023-27538: Fixed SSH connection too eager reuse still (bsc#1209214).\n- CVE-2022-43552: HTTP Proxy deny use-after-free (bsc#1206309).\n- CVE-2023-23916: Fixed HTTP multi-header compression denial of service (bsc#1207992).\n","status":"published","published":"2023-05-17T07:56:12Z","modified":"2026-02-04T04:40:14.720311Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2227-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2023-28320: Fixed siglongjmp race condition (bsc#1211231).\n- CVE-2023-28321: Fixed IDN wildcard matching (bsc#1211232).\n- CVE-2023-28322: Fixed POST-after-PUT confusion (bsc#1211233).\n","status":"published","published":"2023-05-17T07:58:41Z","modified":"2026-02-04T02:48:11.630409Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2228-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2023-28320: Fixed siglongjmp race condition (bsc#1211231).\n- CVE-2023-28321: Fixed IDN wildcard matching (bsc#1211232).\n- CVE-2023-28322: Fixed POST-after-PUT confusion (bsc#1211233).\n- CVE-2023-27533: Fixed TELNET option IAC injection (bsc#1209209).\n- CVE-2023-27534: Fixed SFTP path ~ resolving discrepancy (bsc#1209210).\n- CVE-2023-27535: Fixed FTP too eager connection reuse (bsc#1209211).\n- CVE-2023-27536: Fixed GSS delegation too eager connection reuse (bsc#1209212).\n- CVE-2023-27538: Fixed SSH connection too eager reuse still (bsc#1209214).\n- CVE-2022-43552: HTTP Proxy deny use-after-free (bsc#1206309).\n- CVE-2023-23916: Fixed HTTP multi-header compression denial of service (bsc#1207992).\n","status":"published","published":"2023-05-17T07:59:32Z","modified":"2026-02-04T03:22:09.67432Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2230-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2023-28320: Fixed siglongjmp race condition (bsc#1211231).\n- CVE-2023-28321: Fixed IDN wildcard matching (bsc#1211232).\n- CVE-2023-28322: Fixed POST-after-PUT confusion (bsc#1211233).\n","status":"published","published":"2023-05-17T08:00:26Z","modified":"2026-02-04T03:31:59.225633Z","updated_at":"2026-11-02T15:53:53.019382Z"}]}}