Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-27537

Date: March 29, 2023

A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.

Language: C

Severity Score

Related Resources (8)

https://github.com/curl/curl/commit/076a2f629119222a
https://security-tracker.debian.org/tracker/CVE-2023-27537
https://curl.se/docs/CVE-2023-27537.html
https://nvd.nist.gov/vuln/detail/CVE-2023-27537
https://hackerone.com/reports/1897203
https://security.netapp.com/advisory/ntap-20230420-0010/
https://security.gentoo.org/glsa/202310-12
https://www.mend.io/vulnerability-database/CVE-2023-27537

Severity Score

Weakness Type (CWE)

Double Free

CWE-415

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

Do you need more information?

Contact Us