CVE-2023-27536
MEDIUM
MEDIUM
Priority: 0.10
BB Relevance:
62/100
Published: 2023-03-30
Modified: 2026-10-23
First seen: 2026-10-29
Status: active
Attack Surface
Network
No Auth
No Interaction
Conf. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
None
S:
Unchanged
C:
High
I:
None
A:
None
Description
An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.
Affected Software (12)
| Vendor | Product | Version |
|---|---|---|
| debian | debian_linux | 10.0 |
| fedoraproject | fedora | 36 |
| haxx | libcurl | 7.22.0 – 7.88.1 |
| netapp | active_iq_unified_manager | - |
| netapp | h300s_firmware | - |
| netapp | h410s_firmware | - |
| netapp | h500s_firmware | - |
| netapp | h700s_firmware | - |
| netapp | ontap | 9 |
| splunk | universal_forwarder | 8.2.0 – 8.2.12 |
| splunk | universal_forwarder | 9.0.0 – 9.0.6 |
| splunk | universal_forwarder | 9.1.0 |
References & Advisories (8)
Third Party Advisory
Third Party Advisory
Mailing List
Third Party Advisory
Mailing List
Third Party Advisory
Exploit
Third Party Advisory