LiveActive security incident?Get immediate response
CVE Record

CVE-2023-38545: This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with.

HighCVSS 8.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2023-38545 is a high-severity curl/libcurl flaw in SOCKS5 proxy handling. A long hostname and a slow SOCKS5 handshake can trigger a heap buffer overflow. Business urgency is highest where systems use curl through SOCKS5 proxies and process user-influenced URLs.

Executive priority

Treat as high priority, not a confirmed emergency. Patch internet-facing, proxy-enabled, and URL-fetching systems first, then work through embedded products and appliances. Active exploitation is not supported by the provided evidence, but public PoC references increase remediation urgency.

Technical view

The issue is CWE-787: a heap-based buffer overflow during the SOCKS5 proxy handshake. When remote DNS resolution should be disabled for hostnames over 255 bytes, a state variable can keep the wrong value during slow negotiation, causing the oversized hostname to be copied into a heap buffer.

Likely exposure

Exposure depends on curl/libcurl use with SOCKS5 proxying where hostnames are passed to the proxy. Systems that fetch arbitrary URLs, use proxy egress, or embed libcurl in products need inventory review. The bundle lists curl as affected and shows downstream advisories from NetApp, Fedora, Apple, Siemens, and VMS Software.

Exploitation context

The CVSS score is 8.8 with network attack vector and user interaction required. The bundle does not show CISA KEV listing or active exploitation evidence. It does list public exploit or proof-of-concept GitHub references, so defenders should assume researchers and attackers can study the bug.

Researcher notes

Focus triage on libcurl consumers using SOCKS5 with proxy-side hostname resolution and slow handshakes. The source bundle is incomplete on exact fixed versions and product-specific impact, so rely on curl and vendor advisories for authoritative version mapping.

Mitigation direction

  • Identify curl and libcurl versions across hosts, containers, appliances, and embedded products.
  • Prioritize systems using SOCKS5 proxies or processing untrusted URLs.
  • Apply curl and downstream vendor security updates per official advisories.
  • Where patching is delayed, review vendor guidance for supported mitigations.
  • Track appliance advisories from NetApp, Apple, Siemens, Fedora, and VMS Software.

Validation and detection

  • Check SBOMs and package inventories for curl or libcurl presence.
  • Confirm whether SOCKS5 proxy mode is used in applications or egress paths.
  • Verify updated packages match vendor advisory guidance.
  • Review URL-fetching features for untrusted hostname input paths.
  • Document unresolved embedded or appliance dependencies for vendor follow-up.
Prepared
Confidence
high
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-787: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2023-38545 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
3ADP providers
19Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: noTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.8CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

8.8High
CVSS 3.1 vector shape for CVE-2023-38545Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
curlcurl8.4.0, 7.69.0Listed
Weakness

CWE details

CWE-787

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-787 · source CWE mapping

Out-of-bounds Write

Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs