CVE-2023-28320
MEDIUM
MEDIUM
Priority: 0.16
BB Relevance:
62/100
Published: 2023-05-26
Modified: 2026-10-23
First seen: 2026-10-29
Status: active
Attack Surface
Network
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
None
S:
Unchanged
C:
None
I:
None
A:
High
Description
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
Affected Software (10)
| Vendor | Product | Version |
|---|---|---|
| apple | macos | 11.0 – 11.7.9 |
| apple | macos | 12.0 – 12.6.8 |
| apple | macos | 13.0 – 13.5 |
| haxx | curl | < 8.1.0 |
| netapp | clustered_data_ontap | - |
| netapp | h300s_firmware | - |
| netapp | h410s_firmware | - |
| netapp | h500s_firmware | - |
| netapp | h700s_firmware | - |
| netapp | ontap_antivirus_connector | - |
References & Advisories (9)
Third Party Advisory
Third Party Advisory
Third Party Advisory
Third Party Advisory
Third Party Advisory
Mailing List
Third Party Advisory
Mailing List
Third Party Advisory
Mailing List
Third Party Advisory
Exploit
Patch
Third Party Advisory