TL;DR: CVE-2023-38545 is a heap buffer overflow in curl’s SOCKS5 proxy handshake. It affects libcurl 7.69.0 through 8.3.0, and 8.4.0 includes the fix. Microsoft lists it because Windows ships its own curl.exe. Windows got the fix in the November 2023 cumulative updates. Patch through Windows Update and never swap curl.exe by hand. Then track down the libcurl copies bundled inside other apps, because those are what keep scanners red.
Before the patch landed, curl lead developer Daniel Stenberg called this bug “probably the worst curl security flaw in a long time.” Weeks after the fix shipped, Windows admins were still on Microsoft Q&A saying they could find the MSRC entry but no KB number for Windows Server. Here is what the flaw does, who’s exposed, and how to close it across a mixed fleet.
What Is CVE-2023-38545?
It is a heap buffer overflow in the SOCKS5 proxy handshake of both libcurl and the curl command-line tool. Jay Satiro reported it to the curl project on September 30, 2023, and curl 8.4.0 shipped alongside the public advisory on October 11, 2023.
How the SOCKS5 Heap Overflow Works
When curl lets a SOCKS5 proxy resolve the hostname, the name can be at most 255 bytes. Anything longer should make curl resolve it locally and pass only the address. A bug in that logic, during a slow handshake, makes curl copy the oversized hostname into the buffer anyway. The flaw first appeared when curl rewrote its SOCKS5 handshake from blocking code into a non-blocking state machine.
The timing condition is easy to meet. According to curl, ordinary server latency is likely slow enough, so an attacker does not need a DoS or control of the SOCKS server. One delivery path is a malicious HTTPS server redirecting curl to a crafted URL.
Why the Severity Scores Disagree
The curl project rated it High. NVD scored it 9.8 Critical under CVSS v3.1. The Hacker News reported a CVSS of 7.5 at disclosure. The gap comes from worst-case scoring. The real trigger needs a specific proxy setup, so triage on your configuration, not the number on the scanner report.
Why Microsoft Shows Up in a curl CVE
Every Windows 10 and Windows 11 install has shipped with curl by default since 2017. Microsoft builds and maintains that copy itself. MSRC added this CVE to its Security Update Guide to tell customers Windows was affected and that the curl fix would arrive in a Windows security update.
What Windows Actually Ships
Microsoft says the Windows build gives access to the command-line tool, not the library. Windows 10 fully patched through October 2023 still reported curl 8.0.1, while the fix required 8.4.0.
The November 2023 Patch Tuesday Fix
curl 8.4.0 arrived in the November 14, 2023 cumulative updates, including KB5032189 for Windows 10 22H2, KB5032190 for Windows 11 22H2 and 23H2, KB5032198 for Server 2022, and KB5032202 for Server 23H2. One catch for anyone checking the fix: admins reported that neither the CVE nor curl appeared in those KBs’ release notes, even though curl --version showed 8.4.0 after updating.
Why You Should Never Replace curl.exe by Hand
Swapping in a fresh binary from curl.se feels like the fast fix. Microsoft warns that removing or replacing curl.exe can damage the Windows Update component store and block future security updates. Let the cumulative update handle it.
Who Is Actually Exposed
A system is exposed only when all three of these line up:
- SOCKS5 with remote name resolution. In libcurl this comes from
CURLPROXY_SOCKS5_HOSTNAME, asocks5h://proxy setting, or a proxy environment variable usingsocks5h://. In the curl tool,--socks5-hostnametriggers it too. - A small download buffer. libcurl defaults to 16kB. The curl tool sets 100kB, so it is only vulnerable when a user sets a rate limit below 65,541 bytes per second.
- A hostname longer than that buffer, often delivered through a redirect.
Apps that embed libcurl at its default buffer size carry the most risk. curl itself warns that many apps use libcurl without saying so. Microsoft’s own Linux images were affected as well: CBL-Mariner 2.0 received a fix in October 2023.
How to Find and Fix CVE-2023-38545
Check Every curl Copy, Not Just curl.exe
Run curl --version on Windows hosts first. Then search app folders, containers, and CI runners for bundled libcurl.dll and libcurl.so files. Teams on Microsoft Defender for Cloud can filter inventory findings by this CVE ID to see which machines are affected. This is where business context matters: a flagged copy inside an internet-facing build server deserves attention before one on an offline kiosk.
Patch Paths by Platform
- Windows: install the November 2023 cumulative update or later, since Windows updates are cumulative and include curl 8.4.0 or newer.
- Linux: Debian, Ubuntu, Red Hat, Alpine, and other distros ship fixed packages.
- Third-party apps: wait for the vendor’s update. Bundled copies are theirs to fix.
- Older curl builds you maintain yourself: curl publishes a patch collection for older versions.
Workarounds When You Cannot Patch Yet
- Stop using
CURLPROXY_SOCKS5_HOSTNAMEproxies. - Remove any proxy environment variable that points to
socks5h://. - Raise
CURLOPT_BUFFERSIZEabove 65,541 bytes. - Block outbound SOCKS5 traffic at the firewall except to destinations you trust.
Detection Signals
Watch for unusual outbound connections to SOCKS5 proxies and DNS lookups for very long hostnames. Treat crashes in curl-dependent apps as possible exploit attempts. On endpoints, flag curl-based processes that spawn cmd.exe or powershell.exe.
Why Scanners Still Flag CVE-2023-38545 in 2026
Three years on, this CVE keeps showing up in reports. Public proof-of-concept code exists for both the library and the command-line tool. Wiz shows it is not on the CISA KEV list, but its EPSS exploitation probability sits at 78.7 percent as of November 2026.
The real cost is the labor. Every flag turns into a ticket. Someone has to confirm the version, find the owner, decide on a patch path, and recheck it. Multiply that by hundreds of endpoints and dozens of vendor apps, and a three-year-old bug eats a week of analyst time. Risk-based vulnerability management helps here, but only if someone has the hours to run it.
How Secure.com Helps
Secure.com gives your team governed AI teammates that attack, harden, and prove defensive outcomes. They work above the stack you already own, and your team sets the rules and approves consequential actions.
- Finds every copy: the Infrastructure Security Teammate pulls asset and scanner data from your current tools to list every curl.exe and bundled libcurl across endpoints, servers, cloud, and containers.
- Tests real exposure: it checks for the trigger conditions, such as SOCKS5H settings and small buffer sizes, so priority follows reachability.
- Hardens with approval: it drafts the fix, routes it to the right owner, and holds consequential changes until your team signs off.
- Proves the outcome: it rechecks after patching and attaches evidence for audit and leadership.
- Gives hours back: repeat scanner flags stop landing on your analysts’ desks.
FAQs
Is CVE-2023-38545 exploited in the wild?
Does Windows use the vulnerable libcurl library?
Which Windows update fixes CVE-2023-38545?
curl --version to confirm 8.4.0 or higher, since the KB release notes do not mention curl.
