GitLab's response to curl and libcurl security vulnerability

This post details GitLab's investigation and response to CVE-2023-38545, a heap buffer overflow vulnerability in curl/libcurl via the SOCKS5 protocol. GitLab confirmed no SOCKS5 usage in its GitLab.com and GitLab Dedicated environments, thus no direct impact. For self-managed customers, it advises referencing the curl security advisory for exposure assessment and upgrading to curl version 8.4.0. The investigation involved proactive scoping and analysis of SOCKS5 usage across the GitLab environment.