CVE-2023-28320

What it actually does

Race condition in libcurl synchronous resolver backend using unprotected global buffer with alarm() and siglongjmp() for timeout handling, allowing multi-threaded applications to crash or misbehave during slow name resolution.

Why it matters to the business

Applications relying on curl for network requests in multi-threaded setups can experience unexpected crashes or erratic behavior, leading to service outages, degraded performance, and operational disruptions across dependent software ecosystems.

How an attack unfolds

An attacker initiates network requests that trigger slow DNS resolution in a vulnerable multi-threaded application built with the synchronous resolver; concurrent threads then race on the shared global buffer during signal-based timeout handling via alarm() and siglongjmp(), resulting in process instability.

How to fix it

Upgrade curl to a build incorporating commit a9f8fe28481fef7c28d85b4a12a3a35521408eaf or later; rebuild affected applications against the patched library; consider switching to an asynchronous resolver backend at build time if multi-threaded usage is required.

How to confirm the fix worked

Verify the installed curl version includes the referenced commit; inspect build configuration for resolver backend selection; test multi-threaded name resolution scenarios for absence of crashes under timeout conditions.

Typical attack path

1. Identify target applications or services using curl built with the synchronous resolver backend
2. Send crafted requests designed to induce slow or delayed hostname resolution
3. Exploit concurrent threading to trigger the unprotected global buffer access during signal timeout handling
4. Cause application crash or misbehavior to achieve denial of service

How to detect it

Review application logs and crash dumps for unexpected terminations during hostname resolution in multi-threaded curl usage; correlate with DNS timeout events; examine process traces for signal handler activity around name resolution.

What your security team should do

• Prioritize updating all curl installations and dependent packages to the fixed commit version
• Audit build configurations to prefer asynchronous resolvers in multi-threaded environments
• Monitor for application instability correlated with DNS operations
• Apply updates within standard maintenance windows given stable EPSS and lack of KEV listing