Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-28320

Date: May 25, 2023

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using "alarm()" and "siglongjmp()". When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

Language: C

Severity Score

Related Resources (16)

https://nvd.nist.gov/vuln/detail/CVE-2023-28320
https://support.apple.com/kb/HT213843
http://seclists.org/fulldisclosure/2023/Jul/52
https://access.redhat.com/security/cve/CVE-2023-28320
https://hackerone.com/reports/1929597
https://support.apple.com/kb/HT213844
https://support.apple.com/kb/HT213845
https://security.alpinelinux.org/vuln/CVE-2023-28320
https://seclists.org/oss-sec/2023/q2/166
https://security.gentoo.org/glsa/202310-12
https://github.com/curl/curl/commit/8e21b1a05f3c0ee098dbcb6c
https://security-tracker.debian.org/tracker/CVE-2023-28320
https://security.netapp.com/advisory/ntap-20230609-0009/
http://seclists.org/fulldisclosure/2023/Jul/48
http://seclists.org/fulldisclosure/2023/Jul/47
https://www.mend.io/vulnerability-database/CVE-2023-28320

Severity Score

Weakness Type (CWE)

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE-362

Uncontrolled Resource Consumption

CWE-400

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

Do you need more information?

Contact Us