VYPR
← All advisories
Unrated severityNVD Advisory· Published May 26, 2023· Updated Jan 15, 2025

CVE-2023-28320

CVE-2023-28320

Description

A race condition in curl's synchronous resolver leads to denial of service in multi-threaded applications via a non-mutex-protected global buffer.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A race condition in curl's synchronous resolver leads to denial of service in multi-threaded applications via a non-mutex-protected global buffer.

Vulnerability

A denial of service vulnerability exists in curl <v8.1.0 in the synchronous resolver backend. When libcurl is built to use the synchronous resolver, it uses alarm() and siglongjmp() to time out slow name resolutions. The global buffer used in this process is not mutex protected, leading to a race condition in multi-threaded applications that can cause crashes or other misbehavior [4].

Exploitation

An attacker can trigger a slow name resolution (e.g., by providing a malicious DNS server or delaying responses) in a multi-threaded application using libcurl. If multiple threads simultaneously perform name resolutions that time out, the race condition on the global buffer can cause the application to crash due to undefined behavior.

Impact

Successful exploitation results in a denial of service (application crash) in multi-threaded applications that use libcurl with the synchronous resolver. No privilege escalation or data disclosure is reported.

Mitigation

The vulnerability is fixed in curl version 8.1.0 and later. Gentoo recommends upgrading to >=net-misc/curl-8.3.0-r2 [4]. No known workaround exists; users should update their curl installations.

References
  1. Multiple Vulnerabilities (GLSA 202310-12) — Gentoo security

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

36

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

9

News mentions

0

No linked articles in our index yet.