Improper resource allocation In curl
Description
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 debian 13 | 7.84.0-1 | ||
 alpine v3.13 | 7.79.1-r2 | ||
alpine v3.14 | 7.79.1-r2 | ||
alpine v3.15 | 7.80.0-r2 | ||
alpine v3.17 | 7.84.0-r0 | ||
alpine v3.19 | 7.84.0-r0 | ||
alpine v3.20 | 7.84.0-r0 | ||
alpine v3.21 | 7.84.0-r0 | ||
alpine v3.22 | 7.84.0-r0 | ||
debian 14 | 7.84.0-1 |
1-10 of 17
10
Aliases