Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

curl may lose HTTPS upgrade when parallel URLs run

CVE-2023-23915 · published 3 years ago
Summary

When curl is used with its HTTPS‑only feature (HSTS) and multiple URLs are fetched at the same time, the internal list that remembers which sites should always use HTTPS can be overwritten. As a result, a later request to the same site may fall back to an insecure HTTP connection. Run parallel transfers separately or avoid using the shared HSTS file until the issue is fixed.

What to do
  • Update debian curl to version 7.88.1-1.
  • Update debian rootio-curl to version 7.74.0-1.3+deb11u16.root.io.14.
  • Update debian curl to version 7.74.0-1.3+deb11u16.root.io.14.
  • Update curl to version 7.79.1-r5.
  • Update curl to version 7.80.0-r6.
  • Update curl to version 7.83.1-r6.
  • Update curl to version 7.87.0-r2.
  • Update curl to version 7.88.0-r0.
  • Update haxx curl to version 7.88.0 or later.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian curl < 7.88.1-1
Fix: upgrade to 7.88.1-1
Debian:13 debian curl < 7.88.1-1
Fix: upgrade to 7.88.1-1
Debian:14 debian curl < 7.88.1-1
Fix: upgrade to 7.88.1-1
Root:Debian:11 debian rootio-curl < 7.74.0-1.3+deb11u16.root.io.14
Fix: upgrade to 7.74.0-1.3+deb11u16.root.io.14
Root:Debian:11 debian curl < 7.74.0-1.3+deb11u16.root.io.14
Fix: upgrade to 7.74.0-1.3+deb11u16.root.io.14
– haxx curl >= 7.77.0, < 7.88.0
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
– netapp active_iq_unified_manager All versions
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
– netapp clustered_data_ontap 9.0
cpe:2.3:a:netapp:clustered_data_ontap:9.0:-:*:*:*:*:*:*
– netapp h300s_firmware All versions
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
– netapp h500s_firmware All versions
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
– netapp h700s_firmware All versions
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
– netapp h410s_firmware All versions
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
– splunk universal_forwarder >= 8.2.0, < 8.2.12
>= 9.0.0, < 9.0.6
9.1.0
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
– – https://github.com/curl/curl Fixed in 7.88.0
Alpine:v3.14 – curl >= 7.77.0, < 7.79.1-r5
Fix: upgrade to 7.79.1-r5
Alpine:v3.15 – curl >= 7.77.0, < 7.80.0-r6
Fix: upgrade to 7.80.0-r6
Alpine:v3.16 – curl >= 7.77.0, < 7.83.1-r6
Fix: upgrade to 7.83.1-r6
Alpine:v3.17 – curl >= 7.77.0, < 7.87.0-r2
Fix: upgrade to 7.87.0-r2
Alpine:v3.18 – curl >= 7.77.0, < 7.88.0-r0
Fix: upgrade to 7.88.0-r0
Original advisory text
HSTS amnesia with --parallel
curl's HSTS cache saving behaves wrongly when multiple URLs are requested in
parallel.

Using its HSTS support, curl can be instructed to use HTTPS instead of using
an insecure clear-text HTTP step even when HTTP is provided in the URL. This
HSTS mechanism would however surprisingly fail when multiple transfers are done
in parallel as the HSTS cache file gets overwritten by the most recently
completed transfer.

A later HTTP-only transfer to the earlier hostname would then *not* get
upgraded properly to HSTS.

Reproducible like this:

1. `curl --hsts hsts.txt --parallel https://curl.se https://example.com`
2. `curl --hsts hsts.txt http://curl.se`
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-319Cleartext Transmission of Sensitive Information
Timeline
Published15 Feb 2023
Updated4 Nov 2026
First seen25 Apr 2026
Sources
CURL-CVE-2023-23915 · OSV
CVE-2023-23915 · NVD
DEBIAN-CVE-2023-23915 · OSV
ROOT-OS-DEBIAN-11-CVE-2023-23915 · OSV
CVE-2023-23915 · MITRE
CVE-2023-23915 · OSV
ALPINE-CVE-2023-23915 · OSV
Track software like this
Free during beta