CVE-2023-23916: HTTP multi-header compression denial of service
What the report claims
A server can send an HTTP response with many occurrences of Transfer-Encoding and/or Content-Encoding headers, each allocating a buffer, leading to memory exhaustion.
Compare with curl's recorded outcome
Known vulnerability
A real vulnerability: CVE-2023-23916 HTTP multi-header compression denial of service
Shown for comparison after analysis. The pipeline did not see this label.
ProveIt's finding
There is not enough information to verify the reported bug.
Why this finding?
- No curl source code was retrieved for the target revision (5a9a5e171e18), making it impossible to verify any of the claims about header processing, buffer allocation, or bounds checking.
- The report references a patch and test (test418) but neither the patch nor the test code is included in the provided materials.
- Deterministic checks returned 'nothing_to_check', confirming no code was available for analysis.
What still needs checking
- The curl source code for revision 5a9a5e171e18, particularly the HTTP header parsing and content/transfer encoding handling (likely in lib/http.c or similar).
- The referenced patch that fixes the issue and adds test418.
How this analysis ran 3 claims · 0 citations verified
Checked against curl master on 2023-01-08 (5a9a5e171e18). Dev evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.
Review a draft reply to the reporter
Edit and verify before sending.
Thank you for the report. To assess this issue, we need the curl source code at the revision you tested (5a9a5e171e18) and the patch you mention. Could you provide the relevant files (e.g., lib/http.c, lib/transfer.c) or a link to the patch? Without the code, we cannot verify the claims about unbounded header counts and buffer allocation.
Inspect all claims and source code 3 claims · 0 code excerpts
Report claims
Each listed encoding allocates a buffer
Read the reasoning
No curl source code was provided for the revision in question (5a9a5e171e18). The claim that each listed encoding allocates a buffer cannot be verified without seeing the relevant header parsing and buffer allocation code.
The number of headers is not bounded
Read the reasoning
No curl source code was provided. The claim that the number of Transfer-Encoding and Content-Encoding headers is not bounded cannot be verified without seeing the header processing logic and any loop limits.
An HTTP response can consume all available memory
Read the reasoning
No curl source code was provided. The impact claim that an HTTP response can consume all available memory depends on the previous two claims and cannot be assessed without the implementation.
Read the original report
Source code
No source code was retrieved for this analysis. The evidence may be incomplete.