# HTTP multi-header compression denial of service

curl capped decompression chain length per-header, so a malicious server sending many Transfer-Encoding/Content-Encoding headers triggers a malloc bomb and OOM DoS.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: monnerat
- Disclosed: 2023-02-24
- CVE: CVE-2023-23916
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1886139
- Library page: https://bugbountylibrary.com/r/h1%3A1886139
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:curl technique:incomplete-fix vuln:dos vuln:misconfiguration

**Target:** libcurl HTTP response decompression (Content-Encoding/Transfer-Encoding)
**Root cause:** The cap on chained compression algorithms was enforced per-header rather than globally, so many headers each under the cap yield an unbounded decompression chain, each link allocating a buffer.
**Steps:**
1. Enable automatic decompression in curl (CURLOPT_ACCEPT_ENCODING).
2. Server responds with many `Transfer-Encoding:` and/or `Content-Encoding:` headers, each listing several encodings (e.g. `gzip, gzip, gzip`).
3. curl allocates a buffer per encoding link across all headers, exhausting heap memory.
**How found:** Prior CVE-2022-32206 fixed the decompression-chain cap but only per-header; the researcher noticed the cap could be bypassed by spreading encodings across many headers.
**Exploitation:** A malicious or compromised HTTP server returns a response with a large number of Content-Encoding/Transfer-Encoding headers, each listing multiple compression algorithms, causing curl to allocate buffers for every link and exhaust memory (OOM/DoS).
**Insight:** When a fix caps a resource per-item, check whether the same resource can be multiplied across repeated headers/fields to bypass the per-item limit; incomplete fixes of prior CVEs are prime targets.