Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 17 May 2023 08:41:05 +0200 (CEST)
From: Daniel Stenberg <>
To: curl security announcements -- curl users <>,, libcurl hacking <>,
Subject: curl: CVE-2023-28320: siglongjmp race condition

siglongjmp race condition

Project curl Security Advisory, May 17th 2023 -


libcurl provides several different backends for resolving host names, selected
at build time. If it is built to use the synchronous resolver, it allows name
resolves to time-out slow operations using `alarm()` and `siglongjmp()`.

When doing this, libcurl used a global buffer that was not mutex protected and
a multi-threaded application might therefore crash or otherwise misbehave.


Most platforms and systems build libcurl to use the threaded resolver or with
c-ares, neither of those suffer from this flaw. Most platforms that build with
the synchronous resolver don't feature `alarm()` and `siglongjmp()` and
therefor are not vulnerable either.

Since `alarm()` uses signals, it is not advisable to use in a multi-threaded
environment (signals and threads rarely mix very well) which reduces the risk
that this flaw hurts many users.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2023-28320 to this issue.

CWE-662: Improper Synchronization

Severity: Low


- Affected versions: curl 7.9.8 to and including 8.0.1
- Not affected versions: curl < 7.9.8 and curl >= 8.1.0
- Introduced-in:

libcurl is used by many applications, but not always advertised as such!


The fix is to only support this timeout ability if curl has and can properly
mutex protect the buffer.

- Fixed-in:


  A - Upgrade curl to version 8.1.0

  B - Apply the patch to your local version

  C - Do not use the synchronous name resolver option


This issue was reported to the curl project on April 2 2023. We contacted
distros@...nwall on May 9, 2023.

curl 8.1.0 was released on May 17 2023, coordinated with the publication of
this advisory.


- Reported-by: Harry Sintonen
- Patched-by: Harry Sintonen, Daniel Stenberg

Thanks a lot!



Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.