When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
haxx curl |
||
fedoraproject fedora 37 |
||
fedoraproject fedora 38 |
||
fedoraproject fedora 39 |
||
microsoft windows 10 22h2 |
||
microsoft windows 11 21h2 |
||
microsoft windows 11 22h2 |
||
microsoft windows 11 23h2 |
||
microsoft windows 10 1809 |
||
microsoft windows server 2019 |
||
microsoft windows server 2022 |
||
microsoft windows 10 21h2 |
Vulmon