CVE-2023-28322

What it actually does

The flaw causes libcurl to erroneously invoke the CURLOPT_READFUNCTION callback for data during an HTTP POST when CURLOPT_POSTFIELDS is set, if the same handle was previously used for a PUT that relied on the callback, resulting in transmission of incorrect data, use-after-free, or similar memory corruption during handle reuse.

Why it matters to the business

Applications relying on curl for HTTP transfers risk leaking sensitive data or experiencing crashes when reusing handles across PUT and POST operations, potentially leading to compliance violations, interrupted services, or unexpected data exposure in production environments.

How an attack unfolds

An attacker identifies an application that reuses curl handles, first triggering a PUT request that registers a read callback, then forcing a subsequent POST with CURLOPT_POSTFIELDS; the library logic mishandles the transition and either sends attacker-influenced wrong data or triggers memory errors that may disclose information.

How to fix it

Upgrade curl to a build containing commit a9f8fe28481fef7c28d85b4a12a3a35521408eaf or later; rebuild and redeploy all dependent applications; avoid reusing handles across differing request methods until patched.

How to confirm the fix worked

Verify the installed curl version or source contains the referenced commit; test handle reuse scenarios with PUT followed by POST using CURLOPT_POSTFIELDS to confirm correct callback behavior and absence of memory errors.

Typical attack path

1. Identify target application using libcurl < 8.1.0 with handle reuse patterns
2. Trigger initial PUT request that sets CURLOPT_READFUNCTION
3. Cause follow-on POST request that sets CURLOPT_POSTFIELDS on same handle
4. Observe resulting incorrect data transmission or memory corruption for disclosure or denial of service

How to detect it

Review application logs for unexpected request bodies or memory faults during HTTP transfers; inspect crash dumps or sanitizer reports involving curl handle state transitions; search process traces for repeated use of the same curl handle across differing HTTP methods.

What your security team should do

• Prioritize upgrade of curl to the fixed commit across all builds and containers
• Audit applications for curl handle reuse between PUT and POST operations
• Enable memory safety tooling during testing of HTTP transfer paths
• Monitor upstream curl releases for any follow-on corrections