CVE-2023-23915

What it actually does

HSTS cache file overwrite during parallel transfers in curl <7.88.0 causes subsequent HTTP requests to a previously HSTS-protected host to remain unupgraded, transmitting data in cleartext.

Why it matters to the business

Organizations using curl for automated or concurrent transfers risk unintended exposure of credentials, tokens, or other sensitive data over unencrypted channels, increasing regulatory and reputational exposure especially in high-volume scripting environments.

How an attack unfolds

An attacker positions themselves to observe traffic and triggers an application to issue multiple parallel curl transfers; the resulting HSTS cache corruption allows a later HTTP request to the same host to proceed without HTTPS upgrade, enabling passive interception.

How to fix it

Upgrade curl to the version containing commit 3027611ca6d4cc5510d2d0fccc3e5a074e09a2fb (curl 7.88.0 or newer). Rebuild any statically linked binaries and retest parallel transfer workloads. Where immediate upgrade is impossible, serialize transfers or disable HSTS temporarily.

How to confirm the fix worked

Confirm curl version reports 7.88.0 or later; execute a test with multiple parallel transfers to an HSTS host followed by an HTTP request and verify the request is upgraded to HTTPS.

Typical attack path

1. Identify or influence an application or script that performs concurrent curl transfers to multiple hosts including one that uses HSTS.
2. Cause the application to issue parallel requests so that the final HSTS cache write overwrites entries for the target host.
3. Observe or force a subsequent HTTP-only request to the same hostname.
4. Intercept the resulting cleartext traffic to capture sensitive information.

How to detect it

Review application logs for sequences of parallel curl transfers followed by HTTP requests to previously protected hosts; correlate with network captures showing unexpected HTTP instead of HTTPS to HSTS domains.

What your security team should do

• Prioritize upgrade of all curl instances to 7.88.0+ within 30 days given the 1331 days since disclosure.
• Audit scripts and libraries performing concurrent transfers for HSTS reliance.
• Add curl version checks to build pipelines and container images.
• Monitor EPSS trend (currently low but rising) and re-evaluate if new exploit code appears.