---
id: CVE-2023-46219
title: |-
  When saving HSTS data to an excessively long file name, curl could end up
  removing all contents, making subsequent requests using that file unaware of
  the HSTS status they should otherwise use.
summary: |-
  When saving HSTS data to an excessively long file name, curl could end up
  removing all contents, making subsequent requests using that file unaware of
  the HSTS status they should otherwise use.
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: adp
vendor: curl
product: curl
affected:
  - curl >= 8.4.0 <= 8.4.0
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2025-12-02T20:01:11.822335Z'
exploitAvailable: true
published: '2023-12-12'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T00:04:51.589Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-46219'
references:
  - url: 'https://hackerone.com/reports/2236133'
  - url: 'https://curl.se/docs/CVE-2023-46219.html'
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/
  - url: 'https://www.debian.org/security/2023/dsa-5587'
  - url: 'https://security.netapp.com/advisory/ntap-20240119-0007/'
tags:
  - cve.org
  - exploit-available
epss: 0.01133
epssPercentile: 0.65955
ingestedAt: '2026-10-15T04:46:37.296Z'
---

## Overview

When saving HSTS data to an excessively long file name, curl could end up
removing all contents, making subsequent requests using that file unaware of
the HSTS status they should otherwise use.

## Affected

- `curl >= 8.4.0 <= 8.4.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.