libcurl vulnerabilities in embedded firmware: which CVEs matter, how to find them, how to fix them

Because libcurl is the default HTTP and file-transfer library on embedded Linux, and it is often present more than once. Firmware update clients, cloud connectors, telemetry agents, provisioning scripts and web management back ends all use it, either through the shared libcurl.so.4 or as a statically linked copy inside one binary. curl's own advisories carry the same reminder: "libcurl is used by many applications, but not always advertised as such!"

The number of published CVEs is large. The curl project's security page listed 239 curl and libcurl vulnerabilities on 2026-11-11, and its release table shows 21 published vulnerabilities for 8.22.0, the release before the current 8.23.0 (14 October 2026). Counting the project's JSON vulnerability data for older versions that device images still carry, 7.88.1 (the Debian bookworm base) has 66 entries and 7.68.0 has 74. Most are rated Low or Medium by the curl project, and many apply only to specific protocols, options or TLS libraries.

That spread is the reason a raw CVE count overstates risk. A version-only scan lists every CVE for that version, including flaws in TFTP, SMB, LDAP or NTLM code a lean device build never compiled. The work is narrowing that list to what is actually in the build.

The table below shows the pattern with five advisories. Severity is the curl project's own rating; EPSS is FIRST data dated 2026-11-10; none of the five was in CISA's KEV catalog (version 2026.11.10).

CVE-2023-38545 in detail. The curl advisory explains that when curl passes a hostname to a SOCKS5 proxy for remote resolution, names longer than 255 bytes should switch to local resolution, but "due to a bug, the local variable that means 'let the host resolve the name' could get the wrong value during a slow SOCKS5 handshake" and the too-long hostname is copied into the heap download buffer. That buffer is 16 kB by default in libcurl, and the advisory states that an overflow "is only possible in applications that do not set CURLOPT_BUFFERSIZE or set it smaller than 65541." The hostname comes from the URL, so a malicious HTTPS server redirecting to a crafted URL is one route in. The code path is used when an application sets CURLPROXY_SOCKS5_HOSTNAME or a socks5h:// proxy, including through the http_proxy, HTTPS_PROXY or ALL_PROXY environment variables.

Scores for this one CVE also show why the curl rating and CVSS can differ. NVD's primary CVSS 3.1 score is 9.8; the CISA-ADP secondary score is 8.8; the curl project rates it High. Its disclosure policy says the project does "not support CVSS as a method to grade security vulnerabilities" and uses four levels instead (Low, Medium, High, Critical), taking into account "necessary build configuration, protocols involved, platform specifics" among other factors. For a device, that build-configuration view is usually closer to the real exposure.

TLS backend matters. Embedded builds often use mbedTLS or wolfSSL instead of OpenSSL to save space, and that choice moves CVEs in and out of scope. The CVE-2024-6197 advisory states that "the vulnerable code can only be reached when curl is built to use GnuTLS, wolfSSL, Schannel, Secure Transport or mbedTLS," triggered by a malicious server sending a crafted certificate. The same image with an OpenSSL-backed libcurl is not affected, although it then inherits OpenSSL's own CVEs, which our OpenSSL vulnerabilities in embedded firmware guide covers.

Ask the build itself where you can, and read its link dependencies and configuration where you cannot. Three sources, in order of reliability:

The curl manual describes the -V output directly: the first line includes "the full version of curl, libcurl and other 3rd party libraries linked with the executable," the line starting "Protocols:" "shows all protocols that libcurl reports to support," and the line starting "Features:" lists features such as HTTP2, HTTPS-proxy and AsynchDNS. If HTTP2 is missing from the features line, CVE-2026-92392 and CVE-2024-2398 do not apply. Proxy support has no line of its own in that output, so confirm from the build configuration whether libcurl was built with --disable-proxy, which removes the SOCKS code behind CVE-2023-38545.

Then check use, not only presence. Look for socks5h:// in configuration files, init scripts and environment settings, and for HTTP/2 or proxy options in the calling programs. A proxy environment variable set by a provisioning script is enough to put a daemon on the SOCKS5 path.

Rank by build and use conditions first, exploitation data second, and severity ratings third. In practice:

• Present and reachable, high EPSS or KEV-listed: fix in the next firmware release. CVE-2023-38545 on a 7.69.0 to 8.3.0 build that uses socks5h:// is the clear example; its EPSS score puts it among the top 0.5% of scored CVEs.
• Present, reachable, High severity, low EPSS: schedule promptly. CVE-2026-92392 on an 8.12.0 to 8.22.0 build that uploads over HTTP/2 belongs here; the curl advisory notes it "has been proven to be possible to convert into a Remote Code Execution" under a specific set of conditions.
• Compiled in but not used by any caller: remove the feature at the next rebuild and record the reasoning in a VEX statement.
• Not compiled in, or wrong TLS backend: document as not affected, with the build configuration as evidence.

A KEV listing overrides all of this: a curl CVE added to CISA's catalog is being exploited and goes to the top. EPSS also needs reading with care. CVE-2024-2398, a memory leak rated Medium, has a higher EPSS score than CVE-2026-92392, so use EPSS to order findings that are already confirmed reachable, not to replace the reachability check. Our KEV and EPSS prioritisation guide explains how the two signals combine.

Upgrade or patch, strip unused features from the build, rebuild and re-scan, then keep watching the curl advisories. Each curl advisory lists its own options.

Upgrade or backport. The CVE-2023-38545 advisory recommends upgrading to 8.4.0, applying the patch to the local version, or avoiding CURLPROXY_SOCKS5_HOSTNAME and socks5h:// proxies. For CVE-2026-92392 it is curl 8.23.0, the patch, or not using HTTP/2, and the advisory also lists fixed releases on older lines: 8.14.3, 8.16.2 and 8.20.2. A device pinned to an older libcurl for ABI reasons can carry the fix commit linked from each advisory, as Debian did for 7.88.1.

Build out what the product does not use. The curl INSTALL guide's "Reducing size" section tells embedded builders to "specify as many --disable- and --without- flags on the configure command-line as you can," including --disable-PROTOCOL for every unused URL scheme, --disable-proxy (HTTP and SOCKS proxies), --without-nghttp2 (HTTP/2) and --disable-cookies. A firmware update client that only speaks HTTPS to one server needs very little else. Every protocol removed takes its future CVEs with it, and a smaller library is a side benefit.

Rebuild, re-scan, record. Regenerate the SBOM for the new image, confirm the shipped libcurl version or patch level, and compare it with the previous release. Record "not affected" decisions for compiled-out code in a VEX document; our CSAF and VEX for device makers guide shows the format. The same discipline applies to the other components that usually sit next to libcurl, which our BusyBox vulnerabilities and Dropbear SSH vulnerabilities guides cover.

Track curl's advisories. The curl project is its own CVE Numbering Authority and publishes every advisory on its security page, together with machine-readable data in OSV-format JSON that a build pipeline can poll. Per its disclosure policy, High and Critical issues are fixed in a private branch and distributions on the distros@openwall list are informed no more than seven days before the release. Releases with security fixes are announced on the curl-announce mailing list. Subscribing there, or polling the JSON feed, gives a device team the same starting point as the Linux distributions. Updates still need a working delivery path to devices in the field, which our firmware OTA update security guide covers.

SoftWSP's automated scan unpacks a firmware image, catalogs the software components it can identify in the extracted file system, and records each one's name, version and identifiers. Where the image carries identifiable libcurl version evidence, such as a package database entry, it is matched against CVE records, CISA's KEV catalog and FIRST's EPSS scores. This matching is deterministic code: the code scores, and AI narrates.

AI writes the plain-language explanation on top of that matching: which libcurl CVEs matched, which are KEV-listed or have a high EPSS score, and what version evidence they rest on, with every sentence citing the component, version and record behind it. An engineer reviews every finding before the report is delivered. The judgements this guide describes as manual stay with that engineer: whether SOCKS5, HTTP/2 or a particular TLS backend is compiled in and used, whether a statically linked copy exists inside another binary, and whether a vendor backport already closes a version-matched CVE. Version matching flags Debian's patched 7.88.1 as affected by CVE-2023-38545; the review is where backport evidence turns that into a documented "not affected" decision.

For a specific image, see device & firmware security services.

This guide draws on the curl project's security page, advisories for CVE-2023-38545, CVE-2023-38546, CVE-2024-2398, CVE-2024-6197 and CVE-2026-92392, its JSON vulnerability data, release table, disclosure policy, INSTALL guide and man page, the Debian Security Tracker, Ubuntu's CVE entry, NVD, CISA's KEV catalog (version 2026.11.10) and FIRST EPSS data dated 2026-11-10, all read directly on 2026-11-11.