# CVE-2023-38546: curl libcurl cookie injection via curl_easy_duphandle

Source: https://junglewise.ai/threats/cve-2023-38546-curl-libcurl-cookie-injection-via-curl-easy-duphandle  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-10-18. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2023-38546 · Severity: low · CVSS 3.7 · Published 2023-10-18

A flaw in the libcurl library, which is used by many applications to transfer data over the internet, could allow an attacker to inject unauthorized cookies into a running program. This occurs when a program duplicates a connection handle under specific conditions, causing it to mistakenly load cookie data from a local file named 'none' if one exists. While difficult to exploit, this could allow an attacker with local file access to manipulate how an application interacts with web services, potentially leading to unauthorized session behavior.

Technologies: [Apple iPadOS](https://junglewise.ai/threats/technologies/ipados), [Apple macOS Monterey](https://junglewise.ai/threats/technologies/macos-monterey), [Apple macOS Ventura](https://junglewise.ai/threats/technologies/macos-ventura), [Haxx Libcurl](https://junglewise.ai/threats/technologies/libcurl). Vendors: [Apple](https://junglewise.ai/threats/vendors/apple), [Haxx](https://junglewise.ai/threats/vendors/haxx).

## Quick answers

**Is CVE-2023-38546 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-38546 being exploited in the wild.

**How severe is CVE-2023-38546?** Low severity, with a CVSS score of 3.7, published 18 October 2023.

**Which products and versions are affected?** Apple iPadOS < 16.7.5; Apple macOS Monterey < 12.7.3; Apple macOS Ventura < 13.6.4.

**Is there a fix for CVE-2023-38546?** A patch was published on 2023-10-18: Fixed in curl 8.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-38546 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2023-38546?** Check whether you run Apple iPadOS, Apple macOS Monterey, Apple macOS Ventura or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in libcurl's curl_easy_duphandle() function. When an 'easy handle' with cookies enabled is duplicated, the cookie-enable state is cloned, but the actual cookies are not. If the source handle had not yet loaded cookies from a file, the cloned handle incorrectly sets its internal cookie file path to the literal string 'none'. If a file named 'none' exists in the program's current working directory and follows the correct cookie file format, the cloned handle will inadvertently load its contents. An attacker who can create a file named 'none' in the application's working directory can inject arbitrary cookies into the application's transfers. This issue was resolved in curl version 8.4.0.

## Affected products

- curl libcurl < 8.4.0
- Apple iOS < 16.7.5
- Apple iPadOS < 16.7.5
- Apple macOS Ventura < 13.6.4
- Apple macOS Monterey < 12.7.3

## Timeline

- 2023-10-18: disclosed
- 2023-10-18: patched: Fixed in curl 8.4.0
- 2024-01-22: advisory: Apple released security updates for iOS and macOS addressing this CVE.

## References

- [http://seclists.org/fulldisclosure/2024/Jan/34](http://seclists.org/fulldisclosure/2024/Jan/34)
- [http://seclists.org/fulldisclosure/2024/Jan/37](http://seclists.org/fulldisclosure/2024/Jan/37)
- [http://seclists.org/fulldisclosure/2024/Jan/38](http://seclists.org/fulldisclosure/2024/Jan/38)
- [https://curl.se/docs/CVE-2023-38546.html](https://curl.se/docs/CVE-2023-38546.html)
- [https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868](https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868)
- [https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/)
- [https://support.apple.com/kb/HT214036](https://support.apple.com/kb/HT214036)

## Related threats

- [Apple Bluetooth use-after-free vulnerability](https://junglewise.ai/threats/cve-2026-113970-a-use-after-free-issue-was-addressed-with-improved-memory)
- [Apple iOS, iPadOS, macOS, and related platforms rate limit bypass in AirPlay pairing](https://junglewise.ai/threats/cve-2026-113969-a-logic-issue-was-addressed-with-improved-state-management-this)
- [Apple iOS and iPadOS Bluetooth pairing code rate limit bypass](https://junglewise.ai/threats/cve-2026-113968-a-logic-issue-was-addressed-with-improved-state-management-this)
- [Apple iOS/iPadOS Bluetooth pairing bypass](https://junglewise.ai/threats/cve-2026-113965-this-issue-was-addressed-with-improved-checks-this-issue-is)
- [Apple iOS and iPadOS Bluetooth pairing rate limit bypass in CoreUtils](https://junglewise.ai/threats/cve-2026-113964-a-logic-issue-was-addressed-with-improved-state-management-this)