All vulnerabilities

Servers and applications

CVE-2023-23916

An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a…

Severity
Medium 6.5
Published
23 Feb 2023
Last changed
23 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
7.88.0
Sources
NVD

Affected software

SoftwareAffected versions
curlServers and applications · cpe:a:haxx:curl
  • From 7.57.0 before 7.88.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-23916
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-23916