{"id":"CVE-2023-38545","published":"2023-10-18T03:52:00Z","modified":"2026-10-14T23:35:01Z","title":"This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake","vendor":"curl","product":"curl","tier":"core","eol":null,"affectedVersions":[{"vendor":"curl","product":"curl","versions":[">= 8.4.0, < 8.4.0"]}],"description":{"text":"This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is a heap-based buffer overflow in curl's SOCKS5 proxy handshake code, where a local variable controlling whether the proxy resolves the host name can take the wrong value during a slow handshake, causing an overlong host name to be copied into a heap buffer instead of only the resolved address. An attacker who can supply or influence the host name in a URL that curl is asked to fetch through a SOCKS5 proxy can trigger the overflow, which requires the victim (user interaction) to have curl operate on that URL and a SOCKS5 proxy with host-name resolution to be in use.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:31Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.78689,"percentile":0.99587,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":7,"pulses":[{"name":"Russian Hackers Manipulate NPM to Distribute Malicious Packages","url":"https://otx.alienvault.com/pulse/6804c5f8cfa1999ee4fbff8b","created":"2025-04-20"},{"name":"ACTUALIZACION  IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues","url":"https://otx.alienvault.com/pulse/661d97bab11ed8d2c64cdfd6","created":"2024-04-15"},{"name":"ACTUALIZACION | Oracle Critical Patch Update Advisory - January 2024","url":"https://otx.alienvault.com/pulse/65c0fd55c5d3c780a06aa227","created":"2024-02-05"},{"name":"ACTUALIZACION |  Long Term Support Channel Update for ChromeOS","url":"https://otx.alienvault.com/pulse/6553aa3c56a3b9e10eb9a344","created":"2023-11-14"},{"name":"ACTUALIZACION | IBM Automation Decision Services | 31-10-2023","url":"https://otx.alienvault.com/pulse/6540933d3e118f1e33c15e44","created":"2023-10-31"},{"name":"ACTUALIZACION | Oracle Critical Patch Update Advisory - October 2023","url":"https://otx.alienvault.com/pulse/6531fa57b7edb6c002b800e5","created":"2023-10-20"},{"name":"APT Profile: Dark Pink APT Group","url":"https://otx.alienvault.com/pulse/6528e2ca1ac9af81cbccf1e7","created":"2023-10-13"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"https://curl.se/docs/CVE-2023-38545.html","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20231027-0009/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/","tags":[]},{"url":"https://www.secpod.com/blog/high-severity-heap-buffer-overflow-vulnerability/","tags":[]},{"url":"https://support.apple.com/kb/HT214036","tags":[]},{"url":"https://support.apple.com/kb/HT214063","tags":[]},{"url":"https://support.apple.com/kb/HT214057","tags":[]},{"url":"https://support.apple.com/kb/HT214058","tags":[]},{"url":"http://seclists.org/fulldisclosure/2024/Jan/34","tags":[]},{"url":"http://seclists.org/fulldisclosure/2024/Jan/37","tags":[]},{"url":"http://seclists.org/fulldisclosure/2024/Jan/38","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20240201-0005/","tags":[]},{"url":"https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868","tags":[]},{"url":"https://github.com/bcdannyboy/CVE-2023-38545","tags":["exploit"]},{"url":"https://github.com/dbrugman/CVE-2023-38545-POC","tags":["exploit"]},{"url":"https://github.com/UTsweetyfish/CVE-2023-38545","tags":["exploit"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-943925.html","tags":[]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-832273.html","tags":[]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-093430.html","tags":[]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html","tags":[]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-507364.html","tags":[]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote attacker supplies URL triggering overflow","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy","start":0,"end":69}],"model":"claude-haiku-5-5","confidence":"low","confidenceNote":"needs user interaction; not a public-facing exploit"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Overflow executes when curl processes attacker URL","mappingType":"primary_impact","evidence":[{"from":"description","quote":"The target buffer being a heap based buffer, and the host name coming from the","start":685,"end":763}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-c394fa88286c8c1f33ff","title":"Secure Cloud Analytics Alerts and Observations Reference Guide","publisher":"cisco.com","url":"https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/cloud/reference/Alerts_and_Observations_DV_4_13.pdf","date":null,"mentions":[{"quote":"indicativeofexploitationofCVE-2023-38545.","start":164395,"end":164436}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-42344","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-42344","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":7,"skipped":1,"earliest":"2023-10-11","earliestUrl":"https://github.com/UTsweetyfish/CVE-2023-38545","repos":[{"name":"d0rb/CVE-2023-38545","url":"https://github.com/d0rb/CVE-2023-38545","stars":21,"created":"2023-10-17"},{"name":"UTsweetyfish/CVE-2023-38545","url":"https://github.com/UTsweetyfish/CVE-2023-38545","stars":20,"created":"2023-10-11"},{"name":"imfht/CVE-2023-38545","url":"https://github.com/imfht/CVE-2023-38545","stars":8,"created":"2023-10-12"},{"name":"fatmo666/CVE-2023-38545-libcurl-SOCKS5-heap-buffer-overflow","url":"https://github.com/fatmo666/CVE-2023-38545-libcurl-SOCKS5-heap-buffer-overflow","stars":6,"created":"2023-10-12"},{"name":"bcdannyboy/CVE-2023-38545","url":"https://github.com/bcdannyboy/CVE-2023-38545","stars":4,"created":"2023-10-16"}]},"first":{"date":"2023-10-11","source":"PoC-in-GitHub","url":"https://github.com/UTsweetyfish/CVE-2023-38545"},"provenance":"source"},"exploitRefs":["https://github.com/bcdannyboy/CVE-2023-38545","https://github.com/dbrugman/CVE-2023-38545-POC","https://github.com/UTsweetyfish/CVE-2023-38545"],"flow":[{"stage":"primary","techniques":["T1203"],"provenance":"ai"},{"stage":"related","techniques":["T1190"],"provenance":"ai","lowConfidence":true}],"timeline":[{"date":"2023-10-11","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/UTsweetyfish/CVE-2023-38545","provenance":"source"},{"date":"2023-10-18","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-38545","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":37.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9959"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 7 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":2.05,"detail":"7 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}