{
  "schema_version": "1.5.0",
  "id": "CURL-CVE-2023-23914",
  "aliases": [
    "CVE-2023-23914"
  ],
  "summary": "HSTS ignored on multiple requests",
  "modified": "2026-04-25T17:48:46.00Z",
  "database_specific": {
    "package": "curl",
    "affects": "both",
    "URL": "https://curl.se/docs/CVE-2023-23914.json",
    "www": "https://curl.se/docs/CVE-2023-23914.html",
    "issue": "https://hackerone.com/reports/1813864",
    "CWE": {
      "id": "CWE-319",
      "desc": "Cleartext Transmission of Sensitive Information"
    },
    "award": {
      "amount": "480",
      "currency": "USD"
    },
    "last_affected": "7.87.0",
    "severity": "Low"
  },
  "published": "2023-02-15T08:00:00.00Z",
  "affected": [
    {
      "ranges": [
        {
           "type": "SEMVER",
           "events": [
             {"introduced": "7.77.0"},
             {"fixed": "7.88.0"}
           ]
        },
        {
           "type": "GIT",
           "repo": "https://github.com/curl/curl.git",
           "events": [
             {"introduced": "7385610d0c74c6a254fea5e4cd6e1d559d848c8c"},
             {"fixed": "076a2f629119222aeeb50f5a03bf9f9052fabb9a"}
           ]
        }
      ],
      "versions": [
        "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", 
        "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0"
      ]
    }
  ],
  "credits": [
    {
      "name": "Harry Sintonen",
      "type": "FINDER"
    },
    {
      "name": "Daniel Stenberg",
      "type": "REMEDIATION_DEVELOPER"
    }
  ],
  "details": "curl's HSTS functionality fail when multiple URLs are requested serially.\n\nUsing its HSTS support, curl can be instructed to use HTTPS instead of using\nan insecure clear-text HTTP step even when HTTP is provided in the URL. This\nHSTS mechanism would however surprisingly be ignored by subsequent transfers\nwhen done on the same command line because the state would not be properly\ncarried on.\n\nReproducible like this:\n\n    curl --hsts \"\" https://curl.se http://curl.se\n\nThe first URL returns HSTS information that the second URL fails to take\nadvantage of."
}