{"id":"CVE-2023-46219","title":"When saving HSTS data to an excessively long file name, curl could end up\nremoving all contents, making subsequent requests using that file unaware of\nthe HSTS status they should otherwise use.","summary":"When saving HSTS data to an excessively long file name, curl could end up\nremoving all contents, making subsequent requests using that file unaware of\nthe HSTS status they should otherwise use.","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"adp","vendor":"curl","product":"curl","affected":["curl >= 8.4.0 <= 8.4.0"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2025-12-02T20:01:11.822335Z"},"exploitAvailable":true,"published":"2023-12-12","updated":"2026-10-15","sourceUpdated":"2026-10-15T00:04:51.589Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-46219","references":[{"url":"https://hackerone.com/reports/2236133"},{"url":"https://curl.se/docs/CVE-2023-46219.html"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/"},{"url":"https://www.debian.org/security/2023/dsa-5587"},{"url":"https://security.netapp.com/advisory/ntap-20240119-0007/"}],"tags":["cve.org","exploit-available"],"epss":0.01133,"epssPercentile":0.65955,"ingestedAt":"2026-10-15T04:46:37.296Z","slug":"CVE-2023-46219","body":"## Overview\n\nWhen saving HSTS data to an excessively long file name, curl could end up\nremoving all contents, making subsequent requests using that file unaware of\nthe HSTS status they should otherwise use.\n\n## Affected\n\n- `curl >= 8.4.0 <= 8.4.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":29.2,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[]}