Description
When saving HSTS data to an excessively long file name, curl could end up
removing all contents, making subsequent requests using that file unaware of
the HSTS status they should otherwise use.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| curl | curl | 8.4.0 – ≤ 8.4.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 8.5.0-1 | — |
| Debian 13 | curl | 8.5.0-1 | — |
| Debian 12 | curl | 7.88.1-10+deb12u5 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | curl | 8.5.0-2ubuntu1 | — |
| Ubuntu 22.04 LTS | curl | 7.81.0-1ubuntu1.15 | USN-6535-1 |
| Ubuntu 20.04 LTS | curl | 7.68.0-1ubuntu2.21 | USN-6535-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Core Services 1 | jbcs-httpd24-curl +2 | 8.6.0-3.el7jbcs | RHSA-2024:1316 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-httpd +6 | 2.4.57-9.el7jbcs | RHSA-2024:1316 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_proxy_cluster | 1.3.20-3.el7jbcs | RHSA-2024:1316 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_ssl +1 | 1:2.4.57-9.el7jbcs | RHSA-2024:1316 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-openssl +4 | 1:1.1.1k-17.el7jbcs | RHSA-2024:1316 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | curl | 8.0.1-150400.5.36.1 | SUSE-SU-2023:4659-1 |
| SLES 15 SP4 | curl | 8.0.1-150400.5.36.1 | SUSE-SU-2023:4659-1 |
| SLES 12 SP5 | curl | 8.0.1-11.80.1 | SUSE-SU-2023:4653-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | curl | 8.0.1-11.80.1 | SUSE-SU-2023:4653-1 |
| SLE Micro 5.5 | curl | 8.0.1-150400.5.36.1 | SUSE-SU-2023:4659-1 |
| SLE Micro 5.4 | curl | 8.0.1-150400.5.36.1 | SUSE-SU-2023:4659-1 |
| SLE Micro 5.3 | curl | 8.0.1-150400.5.36.1 | SUSE-SU-2023:4659-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | curl | 8.5.0-1.1 | openSUSE-SU-2024:13509-1 |
| openSUSE Leap 15.5 | curl | 8.0.1-150400.5.36.1 | SUSE-SU-2023:4659-1 |
| openSUSE Leap 15.4 | curl | 8.0.1-150400.5.36.1 | SUSE-SU-2023:4659-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.4 | curl | 8.0.1-150400.5.36.1 | SUSE-SU-2023:4659-1 |
| openSUSE Leap Micro 5.3 | curl | 8.0.1-150400.5.36.1 | SUSE-SU-2023:4659-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | curl | 8.5.0-r0 | — |
| Alpine v3.23 | curl | 8.5.0-r0 | — |
| Alpine v3.22 | curl | 8.5.0-r0 | — |
| Alpine v3.21 | curl | 8.5.0-r0 | — |
| Alpine v3.20 | curl | 8.5.0-r0 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | curl | 8.5.0-r0 | — |
| Alpine v3.18 | curl | 8.5.0-r0 | — |
| Alpine v3.17 | curl | 8.5.0-r0 | — |
| Alpine v3.16 | curl | 8.5.0-r0 | — |
| Alpine v3.15 | curl | 8.5.0-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | curl +4 | 8.5.0-1.amzn2023.0.1 | ALAS2023-2024-472 |
| Amazon Linux 2 | curl +2 | 8.3.0-1.amzn2.0.5 | ALAS2-2024-2385 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cmake | 3.29.6-1 | — |
| Azure Linux 3 | mysql | 8.0.40-1 | — |
| Azure Linux 2 (CBL-Mariner) | curl | 8.5.0-1 | — |
| Azure Linux 2 (CBL-Mariner) | mysql | 8.0.40-1 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | curl | 8.5.0-r0 | — |
Advisories 20
- RHSA-2024:1316 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP3 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- SSA-082556 SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2024-0992 Tenable Security Nessus Network Monitor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 31, 2026
- ICSA-25-162-05 Siemens SIMATIC S7-1500 CPU family CISA ICS & IT advisories · May 14, 2026
- USN-6535-1 curl vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- SUSE-SU-2023:4659-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13509-1 curl-8.5.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-3377 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2023-3060 cURL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 10, 2025
- NCSC-2025-0187 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Jun 10, 2025
- VDE-2024-073 Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware CERT@VDE · May 22, 2025
- SUSE-SU-2023:4653-1 Security update for curl SUSE / openSUSE Security Updates · May 2, 2025
- NCSC-2025-0021 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jan 22, 2025
- NCSC-2024-0433 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Nov 12, 2024
- SSA-331112 SSA-331112: Multiple Vulnerabilities in SINEC NMS Before V3.0 SP1 Siemens ProductCERT · Nov 12, 2024
- ICSA-24-319-04 Siemens SINEC NMS CISA ICS & IT advisories · Nov 12, 2024
- ICSA-24-137-07 Siemens SIMATIC RTLS Locating Manager CISA ICS & IT advisories · Jun 11, 2024
- SSA-093430 SSA-093430: Multiple Vulnerabilities in SIMATIC RTLS Locating Manager before V3.0 Siemens ProductCERT · Jun 11, 2024
- ALAS2-2024-2385 Low: curl security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jan 9, 2024
- ALAS2023-2024-472 Low: curl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jan 8, 2024
References
- https://hackerone.com/reports/2236133
- https://curl.se/docs/CVE-2023-46219.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/
- https://www.debian.org/security/2023/dsa-5587
- https://security.netapp.com/advisory/ntap-20240119-0007/