Description
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | https://github.com/curl/curl | Fixed in 8.1.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 7.88.1-10 | — |
| Debian 13 | curl | 7.88.1-10 | — |
| Debian 12 | curl | 7.88.1-10 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | curl | 8.0.1-150400.5.23.1 | SUSE-SU-2023:2224-1 |
| SLES 15 SP3 | curl | 7.66.0-150200.4.57.1 | SUSE-SU-2023:2227-1 |
| SLES 15 SP2 | curl | 7.66.0-150200.4.57.1 | SUSE-SU-2023:2227-1 |
| SLES 15 SP1 | curl | 7.60.0-150000.51.1 | SUSE-SU-2023:2226-1 |
| SLES 12 SP5 | curl | 8.0.1-11.65.2 | SUSE-SU-2023:2225-1 |
Show 22 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP4 | curl | 7.60.0-4.56.1 | SUSE-SU-2023:2228-1 |
| SLES 12 SP2 | curl | 7.37.0-37.98.1 | SUSE-SU-2023:2230-1 |
| SLES for SAP 15 SP3 | curl | 7.66.0-150200.4.57.1 | SUSE-SU-2023:2227-1 |
| SLES for SAP 15 SP2 | curl | 7.66.0-150200.4.57.1 | SUSE-SU-2023:2227-1 |
| SLES for SAP 15 SP1 | curl | 7.60.0-150000.51.1 | SUSE-SU-2023:2226-1 |
| SLES for SAP 12 SP5 | curl | 8.0.1-11.65.2 | SUSE-SU-2023:2225-1 |
| SLES for SAP 12 SP4 | curl | 7.60.0-4.56.1 | SUSE-SU-2023:2228-1 |
| SLE Real Time 15 SP3 | curl | 7.66.0-150200.4.57.1 | SUSE-SU-2023:2227-1 |
| SLE Micro 5.4 | curl | 8.0.1-150400.5.23.1 | SUSE-SU-2023:2224-1 |
| SLE Micro 5.3 | curl | 8.0.1-150400.5.23.1 | SUSE-SU-2023:2224-1 |
| SLE Micro 5.2 | curl | 7.66.0-150200.4.57.1 | SUSE-SU-2023:2227-1 |
| SLE Micro 5.1 | curl | 7.66.0-150200.4.57.1 | SUSE-SU-2023:2227-1 |
| SLE HPC 15 SP3 | curl | 7.66.0-150200.4.57.1 | SUSE-SU-2023:2227-1 |
| SLE HPC 15 SP2 | curl | 7.66.0-150200.4.57.1 | SUSE-SU-2023:2227-1 |
| SLE HPC 15 SP1 | curl | 7.60.0-150000.51.1 | SUSE-SU-2023:2226-1 |
| SUSE OpenStack Cloud Crowbar 9 | curl | 7.60.0-4.56.1 | SUSE-SU-2023:2228-1 |
| SUSE OpenStack Cloud 9 | curl | 7.60.0-4.56.1 | SUSE-SU-2023:2228-1 |
| SUSE Manager Server 4.2 | curl | 7.66.0-150200.4.57.1 | SUSE-SU-2023:2227-1 |
| SUSE Manager Proxy 4.2 | curl | 7.66.0-150200.4.57.1 | SUSE-SU-2023:2227-1 |
| SUSE Enterprise Storage 7.1 | curl | 7.66.0-150200.4.57.1 | SUSE-SU-2023:2227-1 |
| SUSE Enterprise Storage 7 | curl | 7.66.0-150200.4.57.1 | SUSE-SU-2023:2227-1 |
| SUSE Enterprise Storage 6 | curl | 7.60.0-150000.51.1 | SUSE-SU-2023:2226-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | curl | 8.1.0-1.1 | openSUSE-SU-2024:12940-1 |
| openSUSE Leap 15.5 | curl | 8.0.1-150400.5.23.1 | SUSE-SU-2023:2224-2 |
| openSUSE Leap 15.4 | curl | 8.0.1-150400.5.23.1 | SUSE-SU-2023:2224-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.3 | curl | 8.0.1-150400.5.23.1 | SUSE-SU-2023:2224-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | curl | 8.1.0-r0 | — |
| Alpine v3.23 | curl | 8.1.0-r0 | — |
| Alpine v3.22 | curl | 8.1.0-r0 | — |
| Alpine v3.21 | curl | 8.1.0-r0 | — |
| Alpine v3.20 | curl | 8.1.0-r0 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | curl | 8.1.0-r0 | — |
| Alpine v3.18 | curl | 8.1.0-r0 | — |
| Alpine v3.17 | curl | 8.1.0-r0 | — |
| Alpine v3.16 | curl | 8.1.0-r0 | — |
| Alpine v3.15 | curl | 8.1.0-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cmake | 3.28.2-1 | — |
| Azure Linux 3 | tensorflow | 2.16.1-1 | — |
| Azure Linux 2 (CBL-Mariner) | cmake | 3.21.4-11 | — |
| Azure Linux 2 (CBL-Mariner) | curl | 8.2.1-1 | — |
| Azure Linux 2 (CBL-Mariner) | mysql | 8.0.34-1 | — |
| Azure Linux 2 (CBL-Mariner) | rust | 1.72.0-2 | — |
Advisories 17
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2023-2917 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 30, 2026
- SUSE-SU-2023:2226-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2224-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12940-1 curl-8.1.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2225-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2230-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2228-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2227-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2224-2 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2023-1237 cURL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 6, 2025
- WID-SEC-2024-3377 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- ICSA-24-046-15 Siemens SINEC NMS CISA ICS & IT advisories · Mar 12, 2024
- SSA-943925 SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 Siemens ProductCERT · Mar 12, 2024
- WID-SEC-2023-1614 Tenable Security Nessus Network Monitor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2023
- WID-SEC-2023-1880 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 11, 2023
References
- https://hackerone.com/reports/1929597
- https://security.netapp.com/advisory/ntap-20230609-0009/
- https://support.apple.com/kb/HT213843
- https://support.apple.com/kb/HT213844
- https://support.apple.com/kb/HT213845
- 20230725 APPLE-SA-2023-07-24-6 macOS Big Sur 11.7.9 mailing-list
- 20230725 APPLE-SA-2023-07-24-5 macOS Monterey 12.6.8 mailing-list
- 20230725 APPLE-SA-2023-07-24-4 macOS Ventura 13.5 mailing-list
- GLSA-202310-12 vendor-advisory