Description
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | https://github.com/curl/curl | Fixed in 8.1.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 7.88.1-10 | — |
| Debian 13 | curl | 7.88.1-10 | — |
| Debian 12 | curl | 7.88.1-10 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Core Services 1 | jbcs-httpd24-apr +1 | 1.7.0-8.el7jbcs | RHSA-2023:4629 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-curl +2 | 8.2.1-1.el7jbcs | RHSA-2023:4629 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-httpd +6 | 2.4.57-5.el7jbcs | RHSA-2023:4629 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_security | 2.9.3-29.el7jbcs | RHSA-2023:4629 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_ssl +1 | 1:2.4.57-5.el7jbcs | RHSA-2023:4629 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | curl | 8.0.1-150400.5.23.1 | SUSE-SU-2023:2224-1 |
| SLES 12 SP5 | curl | 8.0.1-11.65.2 | SUSE-SU-2023:2225-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | curl | 8.0.1-11.65.2 | SUSE-SU-2023:2225-1 |
| SLE Micro 5.4 | curl | 8.0.1-150400.5.23.1 | SUSE-SU-2023:2224-1 |
| SLE Micro 5.3 | curl | 8.0.1-150400.5.23.1 | SUSE-SU-2023:2224-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | curl | 8.1.0-1.1 | openSUSE-SU-2024:12940-1 |
| openSUSE Leap 15.5 | curl | 8.0.1-150400.5.23.1 | SUSE-SU-2023:2224-2 |
| openSUSE Leap 15.4 | curl | 8.0.1-150400.5.23.1 | SUSE-SU-2023:2224-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.3 | curl | 8.0.1-150400.5.23.1 | SUSE-SU-2023:2224-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | curl | 8.1.0-r0 | — |
| Alpine v3.23 | curl | 8.1.0-r0 | — |
| Alpine v3.22 | curl | 8.1.0-r0 | — |
| Alpine v3.21 | curl | 8.1.0-r0 | — |
| Alpine v3.20 | curl | 8.1.0-r0 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | curl | 8.1.0-r0 | — |
| Alpine v3.18 | curl | 8.1.0-r0 | — |
| Alpine v3.17 | curl | 8.1.0-r0 | — |
| Alpine v3.16 | curl | 8.1.0-r0 | — |
| Alpine v3.15 | curl | 8.1.0-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | curl +4 | 8.0.1-1.amzn2023.0.1 | ALAS2023-2023-270 |
| Amazon Linux 2 | curl +2 | 8.2.1-1.amzn2.0.2 | ALAS2-2023-2230 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | tensorflow | 2.16.1-1 | — |
| Azure Linux 2 (CBL-Mariner) | curl | 8.2.1-1 | — |
| Azure Linux 2 (CBL-Mariner) | mysql | 8.0.34-1 | — |
| Azure Linux 2 (CBL-Mariner) | rust | 1.72.0-2 | — |
Advisories 17
- RHSA-2023:4629 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- WID-SEC-2023-2917 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 30, 2026
- SUSE-SU-2023:2224-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12940-1 curl-8.1.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2225-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2224-2 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2023-1237 cURL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 6, 2025
- WID-SEC-2024-3377 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- ICSA-24-165-06 Siemens TIM 1531 IRC CISA ICS & IT advisories · Jul 9, 2024
- SSA-337522 SSA-337522: Multiple Vulnerabilities in TIM 1531 IRC before V2.4.8 Siemens ProductCERT · Jul 9, 2024
- NCSC-2024-0246 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Jun 11, 2024
- ICSA-24-046-15 Siemens SINEC NMS CISA ICS & IT advisories · Mar 12, 2024
- SSA-943925 SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 Siemens ProductCERT · Mar 12, 2024
- WID-SEC-2023-1880 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 11, 2023
- ALAS2-2023-2230 Moderate: curl security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 7, 2023
- ALAS2023-2023-270 Moderate: curl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 26, 2023
References
- https://hackerone.com/reports/1913733
- https://security.netapp.com/advisory/ntap-20230609-0009/
- https://support.apple.com/kb/HT213843
- https://support.apple.com/kb/HT213844
- https://support.apple.com/kb/HT213845
- 20230725 APPLE-SA-2023-07-24-6 macOS Big Sur 11.7.9 mailing-list
- 20230725 APPLE-SA-2023-07-24-5 macOS Monterey 12.6.8 mailing-list
- 20230725 APPLE-SA-2023-07-24-4 macOS Ventura 13.5 mailing-list
- GLSA-202310-12 vendor-advisory