LOW 3.7 Microsoft

CVE-2023-28322

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send even when the `CURLOPT_POSTFIELDS` option has been set if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

Microsoft Security Update 2023-May: An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send even when the `CURLOPT_POSTFIELDS` option has been set if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

Affected Products

References

Published: 2023-05-09 · Source: Microsoft · Feed updated: 2026-09-03
This low severity vulnerability with a CVSS score of 3.7 was published on 2023-05-09 via Microsoft. Affected: azl3 tensorflow 2.11.1-1 on Azure Linux 3.0, cm1 curl 7.88.1-2 on CBL Mariner 1.0, cbl2 curl 8.0.1-2 on CBL Mariner 2.0 and 3 more.
vulnfeed aggregates 7805 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.