CVE-2023-23915

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS.

Published: 2023-02-23 Last update: 2026-02-13 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2023-23915 is rated Low Risk (28.8/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.03%). Monitor for updates and reassess as exploit intelligence or EPSS changes.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2023-23915

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2025-12-27 0.05% 0.03% -0.02%
2 2025-12-04 0.02% 0.05% +0.03%
3 2025-12-01 — 0.02% —

Full EPSS history (23 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2023-23915

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
6.5 3.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L)
Some sensitive info could get out, but not a total data dump.
Integrity (I:L)
Attackers could change some data, but it’s limited—not everything goes.
Availability (A:N)
Service keeps running; no real outage angle.
 3.9 2.5 [email protected]
6.5 3.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L)
Some sensitive info could get out, but not a total data dump.
Integrity (I:L)
Attackers could change some data, but it’s limited—not everything goes.
Availability (A:N)
Service keeps running; no real outage angle.
 3.9 2.5 134c704f-9b21-4f2e-91b3-4a467353bcc0

Weakness enumeration for CVE-2023-23915

OS Trackers for CVE-2023-23915

vendor priority summary link
alpine — CVE-2023-23915: 1 source package rows (curl); 52 state rows across 7 repos (3.17-main, 3.18-main, 3.19-main, 3.20-main, 3.21-main, 3.22-main, edge-main); fixed 7, open 45. https://security.alpinelinux.org/vuln/CVE-2023-23915
debian not yet assigned CVE-2023-23915 not yet assigned priority: Debian including 1 source packages (curl), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 4, open 1. https://security-tracker.debian.org/tracker/CVE-2023-23915
gentoo high CVE-2023-23915: 1 GLSA(s) (202310-12), 1 atom(s) (net-misc/curl); latest impact high. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2023-23915
redhat low — https://access.redhat.com/security/cve/CVE-2023-23915
suse high CVE-2023-23915 severity important: SUSE including 351 source package names (0.58.0.1.160:libcurl4-7.79.1-150400.5.15.1, 0.58.0.17.153:curl-7.79.1-150400.5.15.1, …), 811 product×package rows across 252 product lines (Container bci/bci-init, Container bci/dotnet-aspnet, … (252 product lines)): Fixed 572, Known Affected 146, Known Not Affected 93. https://www.suse.com/security/cve/CVE-2023-23915/
ubuntu low CVE-2023-23915 low priority: Ubuntu including 1 source packages (curl), 8 status rows across 8 suites (bionic, focal, jammy, kinetic, lunar, trusty, upstream, xenial): not-affected 4, released 4. https://ubuntu.com/security/CVE-2023-23915

Affected software / configurations for CVE-2023-23915

Vendor Product Version Raw CPE
haxx curl >= 7.77.0, < 7.88.0 cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
netapp active_iq_unified_manager — cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
netapp clustered_data_ontap 9.0 cpe:2.3:a:netapp:clustered_data_ontap:9.0:-:*:*:*:*:*:*
netapp h300s_firmware — cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
netapp h500s_firmware — cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
netapp h700s_firmware — cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
netapp h410s_firmware — cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
splunk universal_forwarder >= 8.2.0, < 8.2.12 cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
splunk universal_forwarder >= 9.0.0, < 9.0.6 cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
splunk universal_forwarder 9.1.0 cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*

References for CVE-2023-23915

cvelogic Threat Intelligence