CVE-2023-27537: broadcom brocade_fabric_operating_system_firmware Double Free
Vulnerability summary
CVE-2023-27537 is a medium (CVSS 5.9) Double Free vulnerability in broadcom brocade_fabric_operating_system_firmware. EPSS estimates a 1.90% chance of exploitation in the next 30 days, higher than 79.3% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 30-03-2023PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · AlpineEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.90%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
+0.04 pp
From 1.86% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Netapp6 products
Alpine1 product
- curl< 8.0.1-r0 | < 7.88.1-r1 | < 8.0.0-r0
Broadcom1 product
Debian1 product
- curl< 7.88.1-7
Haxx1 product
- libcurl7.88.0 | 7.88.1
Splunk1 product
- universal_forwarder≥ 8.2.0, < 8.2.12 | ≥ 9.0.0, < 9.0.6 | 9.1.0
6 vendors · 11 products
References
8 links- security.netapp.com/advisory/ntap-20230420-0010/Third Party Advisory
