CVE-2023-46219

What it actually does

Improper input validation when writing HSTS cache data allows an excessively long filename to cause the entire contents of the HSTS storage file to be removed or truncated, leaving subsequent curl requests without HSTS state.

Why it matters to the business

Organizations relying on curl for secure transfers may lose protection against protocol downgrade attacks on affected hosts, increasing exposure to interception or manipulation of HTTPS traffic until the cache is rebuilt or the tool is updated.

How an attack unfolds

An attacker does not directly trigger the flaw; instead, a vulnerable curl client that has previously stored HSTS data under a path that later resolves to an excessively long filename will silently erase its own HSTS cache file during a save operation, causing future requests to that host to ignore HSTS directives.

How to fix it

Upgrade curl to the version containing commit 7161cb17c01dcff1dc5bf89a18437d9d729f1ecd or later; rebuild any static binaries or containers that embed the vulnerable curl library; verify the updated binary reports the corrected behavior when handling long HSTS filenames.

How to confirm the fix worked

Confirm the installed curl binary or library is built from a source tree at or after commit 7161cb17c01dcff1dc5bf89a18437d9d729f1ecd; test by forcing an HSTS entry whose filename exceeds 255 characters and verifying the cache file is not emptied; monitor package or container manifests for the corrected curl version.

Typical attack path

1. Victim uses a curl-based client or script that persists HSTS data to a file whose derived name exceeds platform limits.
2. curl attempts to write updated HSTS entries and, due to the length validation failure, truncates or empties the cache file.
3. Subsequent curl invocations to the same host proceed without HSTS awareness, allowing any active network attacker to perform SSL stripping or redirect attacks.

How to detect it

Search application and system logs for curl processes that reference HSTS cache files immediately before or after unexpected cache truncation events; examine file-system timestamps and size changes on known HSTS cache paths for sudden zero-byte or truncated files coinciding with curl invocations.

What your security team should do

• Immediately inventory all systems and containers using curl and schedule upgrades to the fixed commit.
• Add curl version checks to build pipelines and dependency scanners to prevent reintroduction of the vulnerable code.
• Review any custom curl wrappers or scripts that manipulate the HSTS cache file and ensure they tolerate or avoid long filenames.