CVE-2023-38545: curl SOCKS5 proxy handshake heap buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 critical with network reachability, no privileges or user interaction, and very high EPSS, though no KEV listing or confirmed exploitation.

What it is

curl contains a heap-based out-of-bounds write (CWE-787) in the SOCKS5 proxy handshake. When a host name longer than 255 bytes is passed for proxy-side resolution, a state variable can take the wrong value during a slow handshake, causing the oversized host name to be copied into a heap buffer instead of the resolved address. The flaw is remotely reachable and can corrupt heap memory.

Impact

An attacker can trigger an out-of-bounds heap write, potentially leading to memory corruption, a crash, or code execution in the context of the process using libcurl. The CVSS vector rates confidentiality, integrity, and availability impact as high.

Attack surface

Reached over the network (AV:N) with no privileges (PR:N) and no user interaction (UI:N) per the CVSS vector. Exploitation requires curl to be configured to use a SOCKS5 proxy with remote name resolution and to process an attacker-influenced URL containing an overlong host name.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is very high (0.78483, 99.563rd percentile), and references include patch and third-party advisories, indicating active attention but no confirmed in-the-wild exploitation in this record.

What to do

• Upgrade curl/libcurl to a version containing the fix referenced in the curl.se advisory (patch first).
• Update or patch downstream products that bundle libcurl, including Fedora, NetApp, Microsoft Windows, and Apple components listed in vendor advisories.
• Avoid using SOCKS5 proxy remote name resolution where possible; prefer local name resolution to reduce exposure.
• Limit or sanitize untrusted URLs passed to curl/libcurl, especially host names exceeding 255 bytes.
• Monitor vendor advisories for updated packages and apply them as they become available.

Detection

• Monitor for curl/libcurl crashes or heap corruption events in applications using SOCKS5 proxies.
• Inspect network traffic for SOCKS5 handshakes carrying unusually long host names (over 255 bytes).
• Audit application logs for URLs with overlong host names processed through curl with proxy resolution enabled.
• Track process crashes or abnormal memory errors in services that embed libcurl.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.