# CVE-2023-38545 high severity vulnerability in cURL: everything you need to know

Heap buffer overflow in curl's SOCKS5 handshake: a slow handshake leaves a stale resolve flag, so an over-255-byte hostname is copied into a fixed buffer.

- Payout: Research
- Severity: high
- Program: curl
- Write-up by: Wiz Research
- Disclosed: 2023-10-11
- CVE: CVE-2023-38545
- Write-up quality: 6/10
- Original: https://www.wiz.io/blog/cve-2023-38545-curl-vulnerability
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-cve-2023-38545-curl-vulnerability
- Tags: area:oss domain:oss impact:dos kind:research platform:threat-intel sev:high tech:curl technique:race-window vuln:dos vuln:memory-corruption

**Target:** libcurl SOCKS5 proxy handshake (socks5h hostname resolution)
**Root cause:** When a hostname exceeds 255 bytes curl should switch to local resolution, but during a slow SOCKS5 handshake the local variable signaling local resolution can hold an incorrect value, so the full long hostname is copied into the target buffer instead of the resolved address.
**Steps:**
1. Configure libcurl to use a SOCKS5 proxy with hostname forwarding (`CURLPROXY_SOCKS5_HOSTNAME` / `socks5h://`).
2. Make a request to a malicious URL whose hostname is longer than 255 bytes.
3. The SOCKS5 handshake is deliberately slowed so the resolve-name flag gets the wrong value.
4. curl copies the entire oversized hostname into the heap buffer, overflowing it.
**Exploitation:** Requires an application using libcurl with a socks5 proxy that fetches an attacker-controlled URL (e.g. a webhook). The attacker supplies a >255-byte hostname and slows the SOCKS5 handshake; the oversized hostname is copied into the heap buffer, corrupting memory. Practical impact is primarily denial of service; no RCE exploit known.
**Insight:** State flags set before a network handshake can go stale when the handshake stalls; audit length-based fallback branches (like >255-byte hostname switching to local resolution) for paths where the fallback flag is not re-asserted after a slow/partial handshake.