Report

CVE-2023-38545: Heap Buffer Overflow in SOCKS5 Hostname Handling

602e818e-ac91-4c38-9265-86b0b6d3b5bb

A heap buffer overflow vulnerability in curl's SOCKS5 proxy handshake when processing hostnames. The vulnerability occurs in the domain name address type (ATYP=3) handling code where the hostname length is truncated to a single byte via an unsafe cast, but the full hostname is still copied into the buffer, causing heap memory corruption.