Vulnerability record · CVE-2023-38039 · published 15 September 2023
CVE-2023-38039: curl unbounded HTTP response headers cause heap exhaustion
Haxx · Curl
curl stores incoming HTTP response headers for later access through the libcurl headers API but imposes no limit on their number or size. A malicious server can stream an endless series of headers until curl exhausts heap memory. This affects curl and libcurl consumers across Linux distributions and Windows platforms.
Description
When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityNetwork-reachable denial of service with no authentication or interaction required, a high EPSS score and public exploit reference, though no KEV listing or ransomware use.
What it is
curl stores incoming HTTP response headers for later access through the libcurl headers API but imposes no limit on their number or size. A malicious server can stream an endless series of headers until curl exhausts heap memory. This affects curl and libcurl consumers across Linux distributions and Windows platforms.
Impact
An attacker-controlled server can drive the client process to run out of heap memory, causing a denial of service through crash or resource exhaustion. There is no confidentiality or integrity impact per the CVSS vector.
Attack surface
Reached over the network when a curl or libcurl client connects to a malicious or compromised HTTP server; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
Not listed in CISA KEV and no ransomware usage documented, but EPSS is 0.58068 (99th percentile) and a HackerOne reference is tagged Exploit, indicating public exploit material exists.
What to do
- Upgrade curl and libcurl to a version containing the fix for CVE-2023-38039, and apply vendor updates for Fedora, Windows, Apple, Gentoo and NetApp products listed in the references.
- Where immediate patching is not possible, restrict or proxy outbound HTTP requests from applications using libcurl so clients cannot reach untrusted servers directly.
- Set memory and process resource limits (for example ulimit or container memory caps) on services that use libcurl to bound the impact of heap exhaustion.
- Inventory embedded or statically linked curl/libcurl copies in applications and firmware, since these are often missed by OS package updates.
Detection
- Monitor curl/libcurl client processes for abnormal memory growth or OOM kills correlated with outbound HTTP connections.
- Inspect HTTP response traffic for unusually large volumes of header data or an excessive number of header lines from a single server.
- Alert on repeated crashes or restarts of services that perform HTTP fetches via libcurl.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
10 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2023-38039 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-38039), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
