CriticalPublic exploitVulnerability

CVE-2023-38545

SOCKS5 Heap Buffer Overflow in curl and libcurl

Published Oct 18, 2023 · Updated 2 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

4 mentions · peak 2 in a dayToday

CVSS9.8Critical · v3.1

EPSS78.7%100th percentile

CISA KEVNoNot listed

In the wildNonePublic exploit, no exploitation reported

Vendors: NetAppVeeam SoftwareCurlFedora ProjectFortinetHaxxMicrosoft Corporation

IdentifiersCVE-2023-38545CWE-122

CVE-2023-38545 is a heap-based buffer overflow in the SOCKS5 proxy handshake implementation of curl and libcurl versions 7.69.0 through 8.3.0 inclusive. When proxy-side hostname resolution is enabled, destination hostnames are limited to 255 bytes. For longer hostnames, curl should resolve the destination locally and send only the resolved address. During a slow SOCKS5 handshake, the hostname-resolution state can become incorrect, causing curl to copy the overlong URL hostname into a heap buffer instead. If the hostname exceeds the available buffer capacity, this causes heap memory corruption. Both libcurl applications and the curl command-line tool can be affected, depending on their proxy and buffer configurations.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can corrupt process memory and crash the application, causing denial of service. Depending on memory layout and attacker control, the overflow may also permit arbitrary code execution in the context of the affected process, potentially compromising its data and privileges. Code execution is a potential outcome, not an established consequence of every trigger; practical exploitability depends on the application's configuration and memory conditions.

Mitigation

If you can’t patch tonight, do this now.

Avoid SOCKS5 configurations that delegate destination hostname resolution to the proxy. Do not use CURLPROXY_SOCKS5_HOSTNAME or the socks5h proxy scheme, including in proxy environment variables; use local hostname resolution instead where operationally feasible. Restrict attacker control over destination URLs, particularly overlong hostnames. These measures reduce exposure but do not replace installing the fix.

Remediation

Patch, then assume compromise.

Upgrade curl and libcurl to version 8.4.0 or later, or install a vendor-supported package containing the backported fix. Update applications and products that bundle vulnerable libcurl copies through their supported vendor updates; updating the system library alone may not replace bundled copies. Product-specific fixes include HCL AppScan Standard 10.4.0 or later and Siemens Desigo-family V8.0 QU2 or later. For affected Siemens V6/V7 installations, follow the vendor procedure to replace CodeMeter Runtime with version 8.40b or later and restart the client/server.

Public exploits

Exploits

6 exploits validated by Mallory's analysis.

View more in app →

CVE-2023-38545This repository contains a Python exploit script (CVE-2023-38545.py) and a README file. The exploit targets a vulnerability in SOCKS proxy servers (CVE-2023-38545). The script connects to a specified SOCKS server and port, then repeatedly sends a malicious HTTP response. The response includes a shell payload in the Location header, which, if executed by the vulnerable server, will open a reverse shell to the attacker's machine using netcat. The payload is a typical bash reverse shell that uses a FIFO file at /tmp/f. The script requires the attacker to specify the target SOCKS server's IP and port, as well as their own IP and port for the reverse shell connection. The README provides a brief description of the exploit's purpose. No detection or fake code is present; this is a functional exploit with a real payload.d0rb · Disclosed Oct 17, 2023 · python · networkOperational CVE-2023-38545This repository is a proof-of-concept exploit designed to test HTTP clients for vulnerabilities related to handling large or malformed HTTP redirect responses. The structure consists of a C-based client ('client.c') that connects to a local HTTP server via a SOCKS5 proxy, and a Python script ('server/cat.py') that serves a large, crafted HTTP 301 response from 'payload.txt' over a netcat listener on port 8000. The README files provide build and usage instructions. The main exploit capability is to deliver an overlong Location header in an HTTP response, potentially triggering buffer overflows or improper handling in the client. No specific CVE or product is targeted, but the setup is generic for testing HTTP client robustness. The endpoints involved are local (127.1:8000 for the server, 127.0.0.1:10801 for the proxy), and the payload is a text-based HTTP response. The repository contains 5 files, with code in C and Python, and is structured for easy setup and testing of the exploit scenario.UTsweetyfish · Disclosed Oct 11, 2023 · c · python · networkPoC CVE-2023-38545This repository provides a proof-of-concept (PoC) exploit for CVE-2023-38545, a vulnerability in curl 7.74.0. The structure includes the full curl 7.74.0 source code, build scripts, and documentation. The main exploit steps are documented in the README.md, which instructs the user to build curl with OpenSSL, run a local SOCKS5 proxy (such as Tor on 127.0.0.1:9050), set the ALL_PROXY environment variable, and execute the curl binary with a very long argument (10,000 'A's). This triggers the vulnerability, demonstrating a crash or abnormal behavior as a PoC. The repository does not contain weaponized or automated exploitation code, but provides a clear demonstration of the issue. No hardcoded remote endpoints are present; the only fingerprintable endpoints are the local curl binary and the local SOCKS5 proxy. The exploit is network-based, as it requires network proxying to trigger the vulnerable code path.imfht · Disclosed Oct 12, 2023 · bash · python · networkPoC CVE-2023-38545-libcurl-SOCKS5-heap-buffer-overflowThis repository provides a proof-of-concept (POC) exploit for CVE-2023-38545, a heap buffer overflow vulnerability in libcurl when using a SOCKS5 proxy and following HTTP redirects to long hostnames. The repository contains three files: 'poc.c' (a C program using libcurl to make an HTTP request via a SOCKS5 proxy), 'server.py' (a Python HTTP server that issues a 301 redirect to a URL with an excessively long hostname), and 'readme.md' (detailed instructions and background). The exploit works by running a local SOCKS5 proxy (e.g., via SSH), starting the malicious HTTP server, and executing the C POC, which triggers the vulnerable code path in libcurl. The main attack vector is network-based, requiring the victim to connect to a malicious server through a SOCKS5 proxy. The endpoints involved are local addresses for the proxy and HTTP server. The exploit demonstrates the vulnerability but does not include weaponized payloads or post-exploitation code.fatmo666 · Disclosed Oct 12, 2023 · c · python · networkPoC CVE-2023-38545-sampleThis repository is a proof-of-concept exploit for CVE-2023-38545, a vulnerability in cURL. The repository contains a Dockerfile to set up a controlled environment with a specific vulnerable version of cURL (7.81.0), a Bash script (malicious_redirect_server.sh) that runs a malicious HTTP server on 127.0.0.1:8000, and a Python script (tgsocksproxy.py) that implements a SOCKS5 proxy on 127.0.0.1:1080. The exploit works by having cURL make a request through the local SOCKS5 proxy to the malicious HTTP server, which responds with an oversized Location header, triggering a segmentation fault in cURL. The README provides detailed setup and usage instructions. The exploit demonstrates denial of service and potential memory corruption, but does not provide a weaponized or post-exploitation payload. The main attack vector is local network communication within the Docker container, and the endpoints involved are 127.0.0.1:8000 (malicious HTTP server) and 127.0.0.1:1080 (SOCKS5 proxy).vanigori · Disclosed Oct 12, 2023 · bash · python · networkPoC CVE-2023-38545This repository is a Proof of Concept (PoC) exploit for CVE-2023-38545, a heap buffer overflow vulnerability in curl (versions 7.69.0 to 8.3.1) when handling HTTP redirects via a SOCKS5 proxy. The repository contains: - `cve202338545.sh`: The main exploit script, written in bash, which checks the installed curl version and orchestrates the test by connecting to a SOCKS5 proxy and an HTTP server. It parses command-line arguments for proxy and server IPs, runs a crafted curl command, and analyzes the output to determine vulnerability status. - `server.py`: A Python script that implements a simple HTTP server on port 8080. It responds to requests with a 301 redirect, where the Location header contains a very large string, designed to trigger the vulnerability in curl. - `setup_socks5.sh`: Bash script to install and configure the Dante SOCKS5 proxy server on port 1080 without authentication, and set up logging. - `cleanup.sh`: Bash script to remove the Dante SOCKS5 proxy and restore the original configuration. - `README.md`: Detailed instructions for setting up the environment, running the exploit, and interpreting results. The exploit is network-based, requiring the target to connect through a SOCKS5 proxy to an HTTP server that serves the malicious redirect. The scripts are modular, allowing for easy setup and cleanup of the test environment. The endpoints involved are the SOCKS5 proxy on port 1080 and the HTTP server on port 8080. The exploit does not provide a weaponized payload but is a reliable PoC for detection and research purposes.bcdannyboy · Disclosed Oct 16, 2023 · bash · python · networkPoC

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

CurlCurlapplication

CurlLibcurlapplication

Fedora ProjectFedoraoperating_system

FortinetFgt Vm64 Kvmapplication

FortinetForticlientwindowsapplication

HaxxLibcurlapplication

Microsoft CorporationWindows 10 1809operating_system

Microsoft CorporationWindows 10 21h2operating_system

Microsoft CorporationWindows 10 22h2operating_system

Microsoft CorporationWindows 11 21h2operating_system

Microsoft CorporationWindows 11 22h2operating_system

Microsoft CorporationWindows 11 23h2operating_system

Microsoft CorporationWindows Server 2019operating_system

Microsoft CorporationWindows Server 2022operating_system

NetAppActiveiq Unified Managerapplication

NetAppOncommand Insightapplication

NetAppOncommand Workflow Automationapplication

Veeam SoftwareBackup Enterprise Managerapplication

External references

References

MITRE CVEcve.org · CVE-2023-38545 NVDnvd.nist.gov/vuln/detail/CVE-2023-38545 MITRE CWE · CWE-122cwe.mitre.org Patchcurl.se/docs/CVE-2023-38545.html Patchsecpod.com/blog/high-severity-heap-buffer-overflow-vulnerability Third Party Advisoryseclists.org/fulldisclosure/2024/Jan/34 Third Party Advisoryseclists.org/fulldisclosure/2024/Jan/37 Third Party Advisoryseclists.org/fulldisclosure/2024/Jan/38 Third Party Advisorylists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ Third Party Advisorysecurity.netapp.com/advisory/ntap-20231027-0009 Third Party Advisorysecurity.netapp.com/advisory/ntap-20240201-0005 Third Party Advisorysupport.apple.com/kb/HT214036 +12 more referencesview more in app

Activity feed

Recent activity

46 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

tenable cloud security pluginsNews · Oct 20, 2026Echo: curl-7.69.1: security update to 7.69.1+e1curl-8.1.1: sec... | Tenable®A heap-based buffer overflow in curl's SOCKS5 proxy handshake. During a slow handshake, incorrect hostname-resolution state can cause a hostname longer than 255 bytes to be copied into a heap buffer instead of the resolved address. The advisory rates the vulnerability critical, with a CVSS v3 base score of 9.8, and states that exploits are available. It recommends updating curl-7.69.1 and related packages to version 7.69.1+e1 or later; the title also identifies an update for curl-8.1.1 to 8.1.1+e1.Read more ↗arxivNews · Oct 14, 2026[2606.00669] NeuroLog: Reasoning You Can Audit -- Neuro-Symbolic Vulnerability Discovery via LLM Facts, Datalog, and SMTA SOCKS5 heap overflow affecting curl 8.3.0, rated CVSS 9.8. The paper uses it as an evaluation case for NeuroLog, reporting successful rediscovery and AddressSanitizer-confirmed crash validation.Read more ↗daniel haxx seNews · Oct 7, 2026Twenty-two pending curl vulnerabilities | daniel.haxx.seA previously disclosed HIGH-severity curl vulnerability that could cause a heap buffer overflow. It is mentioned as historical context for the severity of the forthcoming vulnerability.Read more ↗fortiguardNews · Jan 1, 2026PSIRT | FortiGuard LabsA high-severity heap-based buffer overflow in curl/libcurl's SOCKS5 proxy handshake that can occur when hostname resolution handling goes wrong during a slow handshake.Read more ↗

+25 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity4Community discussion across Reddit, Mastodon, and other social sources.