VYPR
← All advisories
Unrated severityNVD Advisory· Published May 26, 2023· Updated Jan 15, 2025

CVE-2023-28321

CVE-2023-28321

Description

curl <8.1.0 improperly matches wildcard patterns in Subject Alternative Names for IDN hostnames, allowing certificate validation bypass.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

curl <8.1.0 improperly matches wildcard patterns in Subject Alternative Names for IDN hostnames, allowing certificate validation bypass.

## Vulnerability curl versions prior to 8.1.0 contain an improper certificate validation vulnerability in the way they match wildcard patterns in TLS server certificates' Subject Alternative Names (SANs). Curl can be built to use its own name matching function instead of one from a TLS library. This private wildcard matching function mishandles International Domain Name (IDN) hosts: IDN hostnames are converted to punycode (starting with xn--), but the wildcard check can still match patterns like x*, which incorrectly accept certificates that should be rejected.

Exploitation

An attacker needs to obtain a TLS certificate with a crafted wildcard SAN that exploits the flawed matching logic. No special network position is required beyond the ability to serve the certificate during a TLS handshake. The attacker does not need authentication; the vulnerability is triggered automatically when curl connects to a server presenting the malicious certificate.

Impact

Successful exploitation allows an attacker to impersonate a legitimate IDN hostname, leading to potential man-in-the-middle attacks. The impact is information disclosure and compromise of trust in TLS connections, as the attacker's certificate is accepted for a domain it should not match.

Mitigation

The vulnerability is fixed in curl version 8.1.0. Users should upgrade to at least this version. For systems where upgrading is not immediately possible, consider using a TLS library that handles name matching correctly rather than relying on curl's private implementation. Apple's macOS updates referenced in support pages do not explicitly address this CVE; the fix is in curl itself.

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

41

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

12

News mentions

0

No linked articles in our index yet.