Curl 8.4.0 Vulnerability Detection & Mitigation | Qualys
Summary: The curl project pre-announced version 8.4.0, released October 11, 2023, to fix two vulnerabilities: CVE-2023-38545, a high-severity flaw affecting both libcurl and the curl tool that maintainers called arguably the most critical security flaw in curl in recent history, and CVE-2023-38546, a low-severity cookie injection issue affecting only libcurl. Affected version ranges were withheld until disclosure at 06:00 UTC on release day, and the maintainer expected a sizable number of rebuilds, particularly for Docker images and similar entities that bundle their own libcurl copies.
What's compelling: libcurl is embedded in countless applications and operating systems, so the fix is not a single package update but a wave of rebuilds and vendor backports - and Qualys TRU was not aware of in-the-wild exploitation, though proof-of-concept code existed, meaning the window between patch and exploit is the stake.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-38545CVE-2023-38546
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026