CVE-2023-23916

Katalog CVE

CVSS 6.5 · Medium EPSS 1,7%

Kerentanan Allocation of Resources Without Limits or Throttling pada haxx curl, fedoraproject fedora +7 lainnya. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.

Rincian

Terbit di NVD

23 Februari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.debian.org/debian-lts-announce/2023/02/msg00035.html mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQKE6TXYDHOTF... mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202310-12 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20230309-0006/ advisory pihak ketiga
• https://www.debian.org/security/2023/dsa-5365 advisory pihak ketiga
• https://hackerone.com/reports/1826048 exploit · issue tracking