# CVE-2023-38545: curl SOCKS5 heap buffer overflow during handshake

Source: https://junglewise.ai/threats/cve-2023-38545-curl-socks5-heap-buffer-overflow-during-handshake  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-10-18. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2023-38545 · Severity: critical · CVSS 9.8 · Published 2023-10-18

A vulnerability in the popular curl data transfer tool and library could allow an attacker to crash applications or potentially execute unauthorized code. The issue occurs when curl is configured to use a SOCKS5 proxy to connect to a website with an unusually long address. This could lead to system instability or data breaches if a user is redirected to a malicious web address.

Technologies: [Apple iPadOS](https://junglewise.ai/threats/technologies/ipados), [Apple macOS Monterey](https://junglewise.ai/threats/technologies/macos-monterey). Vendors: [Apple](https://junglewise.ai/threats/vendors/apple).

## Quick answers

**Is CVE-2023-38545 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-38545 being exploited in the wild.

**How severe is CVE-2023-38545?** Critical severity, with a CVSS score of 9.8, published 18 October 2023.

**Which products and versions are affected?** Apple iPadOS 16.7.5; Apple macOS Monterey 12.7.3.

**Is there a fix for CVE-2023-38545?** A patch was published on 2024-01-22: Apple released updates for iOS and macOS addressing the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-38545 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-38545?** Check whether you run Apple iPadOS or Apple macOS Monterey at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in libcurl's SOCKS5 proxy handshake implementation. When curl is configured to let the SOCKS5 proxy resolve the hostname (SOCKS5_HOSTNAME), it normally limits hostnames to 255 bytes. However, due to a logic error in the non-blocking state machine, a 'slow' handshake can cause curl to incorrectly attempt to copy a hostname up to 65,535 bytes into a smaller heap-based download buffer (defaulting to 16kB). This occurs because a local variable tracking whether to resolve the name remotely is mismanaged during state transitions. An attacker can trigger this by providing a maliciously crafted URL or via a redirect. The vulnerability is patched in curl version 8.4.0.

## Affected products

- curl curl 7.69.0 to 8.3.0
- curl libcurl 7.69.0 to 8.3.0
- Apple iOS 16.7.5
- Apple iPadOS 16.7.5
- Apple macOS Monterey 12.7.3

## Timeline

- 2023-10-11: advisory: Original project advisory published
- 2023-10-18: disclosed: NVD publication date
- 2024-01-22: patched: Apple released updates for iOS and macOS addressing the issue

## References

- [http://seclists.org/fulldisclosure/2024/Jan/34](http://seclists.org/fulldisclosure/2024/Jan/34)
- [http://seclists.org/fulldisclosure/2024/Jan/37](http://seclists.org/fulldisclosure/2024/Jan/37)
- [http://seclists.org/fulldisclosure/2024/Jan/38](http://seclists.org/fulldisclosure/2024/Jan/38)
- [https://curl.se/docs/CVE-2023-38545.html](https://curl.se/docs/CVE-2023-38545.html)
- [https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868](https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868)
- [https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/)
- [https://security.netapp.com/advisory/ntap-20231027-0009/](https://security.netapp.com/advisory/ntap-20231027-0009/)

## Related threats

- [Apple Bluetooth use-after-free vulnerability](https://junglewise.ai/threats/cve-2026-113970-a-use-after-free-issue-was-addressed-with-improved-memory)
- [Apple iOS, iPadOS, macOS, and related platforms rate limit bypass in AirPlay pairing](https://junglewise.ai/threats/cve-2026-113969-a-logic-issue-was-addressed-with-improved-state-management-this)
- [Apple iOS and iPadOS Bluetooth pairing code rate limit bypass](https://junglewise.ai/threats/cve-2026-113968-a-logic-issue-was-addressed-with-improved-state-management-this)
- [Apple iOS/iPadOS Bluetooth pairing bypass](https://junglewise.ai/threats/cve-2026-113965-this-issue-was-addressed-with-improved-checks-this-issue-is)
- [Apple iOS and iPadOS Bluetooth pairing rate limit bypass in CoreUtils](https://junglewise.ai/threats/cve-2026-113964-a-logic-issue-was-addressed-with-improved-state-management-this)