PatchTheCVECVE-2023-27537: A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles"
51
This week
MEDIUM 5.9REMOTEDOWNGRADEMITIGATEDOWNGRADE
CVE-2023-27537 is a medium-severity flaw (CVSS 5.9) affecting libcurl, active iq unified manager, clustered data ontap. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
Why this priority
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.9 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.9% (top 20%) |
| CISA exploited list | No |
| Weakness | CWE-415 |
| Published | 2023-03-30 |
| Last modified | 2026-10-23 |
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
haxx libcurl DOWNGRADE
Affected: 7.88.0 · 7.88.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 7.88.0
1. Check installed version
apt-cache policy libcurl || rpm -q libcurl || libcurl --version
2. No fixed release: DOWNGRADE to a release before 7.88.0 (Debian / Ubuntu)
apt-cache madison libcurl
sudo apt install libcurl=<VERSION_BEFORE_7.88.0>
sudo apt-mark hold libcurl
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list libcurl
sudo dnf downgrade libcurl-<VERSION_BEFORE_7.88.0>
sudo dnf versionlock add libcurl
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
netapp active iq unified manager MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy active-iq-unified-manager || rpm -q active-iq-unified-manager || active-iq-unified-manager --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
netapp clustered data ontap DOWNGRADE
Affected: 9.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 9.0
1. Check installed version
apt-cache policy clustered-data-ontap || rpm -q clustered-data-ontap || clustered-data-ontap --version
2. No fixed release: DOWNGRADE to a release before 9.0 (Debian / Ubuntu)
apt-cache madison clustered-data-ontap
sudo apt install clustered-data-ontap=<VERSION_BEFORE_9.0>
sudo apt-mark hold clustered-data-ontap
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list clustered-data-ontap
sudo dnf downgrade clustered-data-ontap-<VERSION_BEFORE_9.0>
sudo dnf versionlock add clustered-data-ontap
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
broadcom brocade fabric operating system firmware MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
netapp h300s firmware MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
netapp h500s firmware MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
Exact fixes by distribution
A distro patch exists: prefer upgrading over downgrading.
Fedora 46 · python-openslide · FIXED · 1.4.7-1.fc46 · FEDORA-2026-336bea884e · source
sudo dnf upgrade --advisory=FEDORA-2026-336bea884e
Fedora ELN · valgrind · FIXED · 3.28.0-1.eln159 · FEDORA-2026-c593ef1d15 · source
sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15
Ubuntu 20.04 · curl · NOT AFFECTED
Ubuntu 22.04 · curl · NOT AFFECTED
Debian 12 · curl · FIXED · 7.88.1-7
sudo apt update && sudo apt install --only-upgrade curl
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' curl)" ge "7.88.1-7" && echo PATCHED || echo STILL-VULNERABLE
Debian 13 · curl · FIXED · 7.88.1-7
sudo apt update && sudo apt install --only-upgrade curl
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' curl)" ge "7.88.1-7" && echo PATCHED || echo STILL-VULNERABLE
RHEL 6 · curl · NOT AFFECTED
RHEL 7 · curl · NOT AFFECTED
RHEL 8 · curl · NOT AFFECTED
RHEL 9 · curl · NOT AFFECTED
Alpine 3.20 · curl · FIXED · curl-8.0.0-r0
apk add --upgrade curl
apk info -v curl
Alpine 3.21 · curl · FIXED · curl-8.0.0-r0
apk add --upgrade curl
apk info -v curl
Alpine 3.22 · curl · FIXED · curl-8.0.0-r0
apk add --upgrade curl
apk info -v curl
Alpine 3.23 · curl · FIXED · curl-8.0.0-r0
apk add --upgrade curl
apk info -v curl
sudo dnf update --advisory=ALAS2023-2023-193
sudo yum update --advisory=ALAS2-2023-2070
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2023-27536 MEDIUM 5.9 UPGRADE MITIGATE An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse p