CVE-2023-28320 Information
Description
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names selected at build time. If it is built to use the synchronous resolver it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
Reference
https://hackerone.com/reports/1929597
A
denial
of
service
vulnerability
exists
in
curl
<v8.1.0
in
the
way
libcurl
provides
several
different
backends
for
resolving
host
names
selected
at
build
time.
If
it
is
built
to
use
the
synchronous
resolver
it
allows
name
resolves
to
time-out
slow
operations
using
alarm()
and
siglongjmp().
When
doing
this
libcurl
used
a
global
buffer
that
was
not
mutex
protected
and
a
multi-threaded
application
might
therefore
crash
or
otherwise
misbehave.