CVE-2023-27536: Debian Linux

Medium severity, CVSS 5.9. EPSS: 1.6% chance of exploitation in the next 30 days.

An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 36 only
• Haxx Libcurl: from 7.22.0, up to and including 7.88.1
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp h300s Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Netapp Ontap: version 9 only
• Splunk Universal Forwarder: from 8.2.0, before 8.2.12 (fixed in 8.2.12); from 9.0.0, before 9.0.6 (fixed in 9.0.6); version 9.1.0 only

Published 2023-03-30. Last modified 2026-06-17.