Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

curl may skip HTTPS protection when multiple URLs run together

CVE-2023-23914 · published 3 years ago
Summary

The curl command-line tool (versions before 7.88.0) can lose its HTTPS‑only setting when asked to fetch several URLs one after another. This means that even if curl is told to use secure HTTPS, it might fall back to an unencrypted HTTP request for later URLs, exposing data. Upgrade curl to the latest version or avoid chaining multiple URLs in a single command until the fix is applied.

What to do
  • Update debian curl to version 7.88.1-1.
  • Update debian rootio-curl to version 7.74.0-1.3+deb11u16.root.io.14.
  • Update debian curl to version 7.74.0-1.3+deb11u16.root.io.14.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian curl < 7.88.1-1
Fix: upgrade to 7.88.1-1
Debian:13 debian curl < 7.88.1-1
Fix: upgrade to 7.88.1-1
Debian:14 debian curl < 7.88.1-1
Fix: upgrade to 7.88.1-1
Root:Debian:11 debian rootio-curl < 7.74.0-1.3+deb11u16.root.io.14
Fix: upgrade to 7.74.0-1.3+deb11u16.root.io.14
Root:Debian:11 debian curl < 7.74.0-1.3+deb11u16.root.io.14
Fix: upgrade to 7.74.0-1.3+deb11u16.root.io.14
Original advisory text
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, c...
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.
References
Severity
9.1 Critical
CVSS 3.1: 9.1 (OSV)
Exploitation
EPSS <1%
Timeline
Published23 Feb 2023
Updated25 Sep 2026
First seen25 Apr 2026
Sources
CURL-CVE-2023-23914 · OSV
CVE-2023-23914 · NVD
ROOT-OS-DEBIAN-11-CVE-2023-23914 · OSV
DEBIAN-CVE-2023-23914 · OSV
Track software like this
Free during beta