Synced 17 Jun 2026 22:27 UTC Account
← All products

CVE-2023-38039

HIGH severity · CVSS 7.5 · Resource exhaustion
7.5CVSS HIGH

Summary

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.

Impact & exploitability

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
Confidentiality impactNone
Integrity impactNone
Availability impactHigh
Exploit probability (EPSS)62%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products we track (2)

Windows Server 2022curl

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Official patch: https://hackerone.com/reports/2072338 ↗

Additional information