CVE-2023-28320

Name of the Vulnerable Software and Affected Versions curl versions prior to 8.1.0

Description A denial of service issue exists in the way libcurl provides several different backends for resolving host names. If libcurl is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). This can cause a multi-threaded application to crash or misbehave due to a global buffer that is not mutex protected. The issue can be exploited by a remote attacker to cause a denial of service.

Recommendations For versions prior to 8.1.0, update to version 8.1.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the synchronous resolver backend in multi-threaded applications until a patch is available. Restrict access to the vulnerable alarm() and siglongjmp() functions to minimize the risk of exploitation.