Act
active
curl 8.23.0 Patches HTTP/2 Upload Memory Corruption with Public PoC
- Engineer — Act: A public PoC demonstrating client-side code execution exists; curl is present in virtually every container base image, CI/CD runner, and server. Patch to curl 8.23.0 now — check container base images, pipeline runners, and any service that uploads via HTTP/2.
- SOC/IR — Learn: No IOCs, no active exploitation reported, and the attack surface (malicious server exploiting an uploading client) offers limited detection opportunity; understanding the attack vector is useful for triage context if crashes or anomalous curl behavior surface later.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.