curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution
-
The curl project has patched a memory corruption issue affecting how the tool handles HTTP/2 uploads. The flaw allows a malicious server receiving an upload to corrupt the uploading client's memory, and the researcher who reported it was able to turn that corruption into code execution on the client machine.
The fix landed on October 14 in curl 8.23.0.
Exploiting this in the wild is not straightforward. Taking over a client requires exact knowledge of its specific build and memory layout, which significantly narrows the pool of practical targets. According to the curl project, a real-world attack is expected to result in a crash rather than reliable compromise.
- Update to curl 8.23.0 or later to address the flaw.
- Treat uploads to untrusted or attacker-controlled HTTP/2 servers as a potential risk until patched.
Note: The project has not published a specific advisory identifier for this issue in the available reporting.
Source: The Hacker News
Has your organization already rolled out curl 8.23.0, or are you still assessing exposure across your build pipelines?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login