Low
HSTS long filename clears contents
Type: advisorySources: OSV
When saving HSTS data to an excessively long filename, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-46219
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:37 UTC · Revision 1
Source evidence
When saving HSTS data to an excessively long filename, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.
osv:CURL-CVE-2023-46219
Complete source record
{
"id": "d2a62532e9e0e4ca7df3f2833d7114bb77fc04eba349d9778b0bd7182f7d9b30",
"url": "https://osv.dev/vulnerability/CURL-CVE-2023-46219",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "HSTS long filename clears contents",
"summary": "When saving HSTS data to an excessively long filename, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.",
"evidence": "osv:CURL-CVE-2023-46219",
"products": [],
"severity": "low",
"structured": {
"id": "CURL-CVE-2023-46219",
"aliases": [
"CURL-CVE-2023-46219",
"CVE-2023-46219"
],
"affected": [
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "7.84.0"
},
{
"fixed": "8.5.0"
}
]
},
{
"repo": "https://github.com/curl/curl.git",
"type": "GIT",
"events": [
{
"introduced": "20f9dd6bae50b7223171b17ba7798946e74f877f"
},
{
"fixed": "73b65e94f3531179de45c6f3c836a610e3d0a846"
}
]
}
],
"versions": [
"8.4.0",
"8.3.0",
"8.2.1",
"8.2.0",
"8.1.2",
"8.1.1",
"8.1.0",
"8.0.1",
"8.0.0",
"7.88.1",
"7.88.0",
"7.87.0",
"7.86.0",
"7.85.0",
"7.84.0",
"tiny-curl-8_4_0",
"curl-8_4_0",
"curl-8_3_0",
"curl-8_2_1",
"curl-8_2_0",
"curl-8_1_2",
"curl-8_1_1",
"curl-8_1_0",
"curl-8_0_1",
"curl-8_0_0",
"curl-7_88_1",
"curl-7_88_0",
"curl-7_87_0",
"curl-7_86_0",
"curl-7_85_0",
"curl-7_84_0"
],
"database_specific": {
"source": "https://curl.se/docs/CURL-CVE-2023-46219.json",
"vanir_signatures": [
{
"id": "CURL-CVE-2023-46219-345f4148",
"digest": {
"length": 1181,
"function_hash": "322521448480441824076349091693471863624"
},
"source": "https://github.com/curl/curl.git/commit/73b65e94f3531179de45c6f3c836a610e3d0a846",
"target": {
"file": "lib/fopen.c",
"function": "Curl_fopen"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2023-46219-8fb0e127",
"digest": {
"threshold": 0.9,
"line_hashes": [
"141771554961623801452922120631762225644",
"82787012570203242169153838112032331236",
"294693242851234537244736533753545159362",
"12424288094917010005575599408517436759",
"124428138736793990568618883161584762487",
"300507652766921692831964778527059029956",
"168911649268973449864992550166069421481",
"106900510572222239508388653374741936645",
"319267685858350145932267975915255711338",
"93967306247015248528650144731437315148",
"72963164035412696461093506355303529437",
"182001560438617645742021710878070899227",
"333765855877198845699797559849505697945",
"183889325021050708559981981758921351838",
"222364463068963623330822235027063156518",
"137965764669989750475839444417327880578",
"105094198410978040163287063016242362114",
"93579072356192464791921231798830910095",
"183150360300328616239417757634531496897",
"87531163363730378660501473877928006252",
"266430157886770284926444102501263520649",
"163315384743240797309299526992266223294",
"185289273960668621851294809427430254831",
"322027284671455959894357038395360261908",
"97553119457857174697571054867947585806",
"41556339523477586271285710666600171980",
"173229717581375388273969815577773595020",
"14957658089440140526234514041175034353"
]
},
"source": "https://github.com/curl/curl.git/commit/73b65e94f3531179de45c6f3c836a610e3d0a846",
"target": {
"file": "lib/fopen.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-25T01:04:39Z"
}
}
],
"modified": "2026-10-25T01:04:39.310817386Z",
"provider": "osv",
"references": [],
"provider_metadata": {
"CWE": {
"id": "CWE-311",
"desc": "Missing Encryption of Sensitive Data"
},
"URL": "https://curl.se/docs/CVE-2023-46219.json",
"www": "https://curl.se/docs/CVE-2023-46219.html",
"award": {
"amount": "540",
"currency": "USD"
},
"issue": "https://hackerone.com/reports/2236133",
"affects": "both",
"package": "curl",
"severity": "Low",
"last_affected": "8.4.0"
}
},
"related_cves": [
{
"value": "CVE-2023-46219",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 444272,
"published_at": "2023-12-06T08:00:00+00:00"
}