CVE-2023-38545: So you cURL, but will you cIRL? | Grey Noise Blog
Summary: On October 11th, 2023, a heap-based buffer overflow in curl was disclosed as CVE-2023-38545, affecting libcurl 7.69.0 through 8.3.0. Reaching the vulnerable code path requires the application to use a SOCKS5 proxy mode and attempt to resolve a hostname of extraneous length, which GreyNoise reproduced in a controlled environment by requesting a hostname of 10,000 A's and causing a segmentation fault.
Key Takeaway: GreyNoise found that few vulnerable curl deployments could be remotely triggered, and exploiting the bug requires an attacker to already hold privileged access, such as the ability to set the http_proxy environment variable - so the practical exposure sits with embedded libcurl in applications configured for SOCKS5, not with curl itself.
Read the original at GreyNoise Blog ↗
- Topics
- Identity & Access Management
- Mentions
- CVE-2023-38545
- Related
- Curl 8.4.0 Vulnerability Detection & Mitigation | Qualys Cyber Risks ·FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026