Heap-based Buffer Overflow Affecting curl package, versions [7.69.0,8.4.0)



    Attack Complexity High
    Confidentiality High
    Integrity High

    Threat Intelligence

    Exploit Maturity Proof of concept
    EPSS 0.07% (28th percentile)
Expand this section
9.8 critical
Expand this section
8.1 high
Expand this section
Red Hat
8.1 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • published 4 Oct 2023
  • disclosed 4 Oct 2023
  • credit Jay Satiro

How to fix?

Upgrade curl to version 8.4.0 or higher.


curl is a command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S, RTMP, RTMPS, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET and TFTP. libcurl offers a myriad of powerful features.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the SOCKS5 proxy handshake process when the hostname is longer than the target buffer and larger than 255 bytes. The local variable socks5_resolve_local could get the wrong value during a slow SOCKS5 handshake. Since the code wrongly thinks it should pass on the hostname, even though the hostname is too long to fit, the memory copy can overflow the allocated target buffer.

This is only exploitable if the SOCKS5 handshake is slow enough to trigger a local variable bug and the client uses a hostname longer than the download buffer.

Exploiting this vulnerability could allow an attacker to execute arbitrary code on the target system under certain conditions.


An overflow is only possible in applications that don't set CURLOPT_BUFFERSIZE or set it smaller than 65541. Since the curl tool sets CURLOPT_BUFFERSIZE to 100kB by default, it is not vulnerable unless the user sets the rate limiting to a rate smaller than 65541 bytes/second.

The options that cause SOCKS5 with remote hostname to be used in libcurl:

  1. CURLOPT_PROXYTYPE set to type CURLPROXY_SOCKS5_HOSTNAME, or: CURLOPT_PROXY or CURLOPT_PRE_PROXY set to use the scheme socks5h://

  2. One of the proxy environment variables can be set to use the socks5h:// scheme. For example, http_proxy, HTTPS_PROXY or ALL_PROXY.

The options that cause SOCKS5 with remote hostname to be used in the curl tool:

  1. --socks5-hostname, --proxy or --preproxy set to use the scheme socks5h://

  2. Environment variables as described in the libcurl section.


2023-10-04: Initial publication

2023-10-11: Published updated information, including CWE, CVSS, official references and affected versions range.