Race condition on global `gss_context` during SOCKS5 GSS-API negotiation in libcurl

业务逻辑 / Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') / #3356088

厂商

curl

严重程度

低危

赏金

—

弱点

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

研究员

@giant_anteater

披露日期

2025-09-26

资产

https://github.com/curl/curl

CVE

—

该报告还没有中文解读。

Summary: Concurrent SOCKS5 GSS-API authentications share a file-scope global `gss_context` without synchronization, causing data races and undefined behavior.

static gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT;