CVE intelligence

CVE-2023-28322

Vulnerability intelligence

Published May 26, 2023Sources checked Oct 29, 2026

3.7LOWCVSS out of 10

What this means

Review the available evidence

CVE-2023-28322 and is rated Low severity with a CVSS score of 3.7. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Aug 17, 2026

Vendor remediation details

CBL-Mariner Releases

Vendor-listed releases

2.16.1-1
7.88.1-2
8.0.1-2
3.21.4-6
3.21.4-10

CISA KEVNot listedBased on the latest collected catalog

EPSS2.2%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2023-28322?

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback.

This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

Source: NVD