{
  "cveId": "CVE-2023-28320",
  "url": "https://patchblox.com/security/cve/CVE-2023-28320",
  "summary": "CVE-2023-28320 is fixed in curl on 1 platform, first by DEBIAN-CVE-2023-28320, released May 26, 2023. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "curl: A denial of service vulnerability exists in curl \u003Cv8.1.0 in the way libcurl provides several different backends for r...",
  "description": "A denial of service vulnerability exists in curl \u003Cv8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using \u0060alarm()\u0060 and \u0060siglongjmp()\u0060. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.",
  "published": "2023-05-26T21:15:15Z",
  "severity": "medium",
  "cvss": 5.9,
  "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.02658,
  "epssPercentile": 0.8577,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "curl",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "7.88.1-10",
      "fix": "DEBIAN-CVE-2023-28320",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-28320",
      "released": "2023-05-26T21:15:15Z"
    },
    {
      "platform": "linux",
      "product": "curl",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "7.88.1-10",
      "fix": "DEBIAN-CVE-2023-28320",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-28320",
      "released": "2023-05-26T21:15:15Z"
    },
    {
      "platform": "linux",
      "product": "curl",
      "release": "Debian 14",
      "fixedVersion": "7.88.1-10",
      "fix": "DEBIAN-CVE-2023-28320",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-28320",
      "released": "2023-05-26T21:15:15Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}