# Blog: Introducing Falco 0.36.1

DevFeed: [Blog: Introducing Falco 0.36.1](<https://devfeed.tech/articles/blog-introducing-falco-0-36-1-32480.md>)

Original publisher: [Read original article](<https://falco.org/blog/falco-0-36-1/>)

Published: 2023-10-16T00:00:00Z

Content type: release

Language: en

Sources: [Falco - Falco](<https://devfeed.tech/sources/falco-falco.md>), [Falco - The Falco blog](<https://devfeed.tech/sources/falco-the-falco-blog.md>)

Topics: [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [eBPF](<https://devfeed.tech/topics/ebpf.md>), [bug](<https://devfeed.tech/topics/bug.md>), [cpu](<https://devfeed.tech/topics/cpu.md>)

Tags: [blog](<https://devfeed.tech/tags/blog.md>), [bug](<https://devfeed.tech/tags/bug.md>), [cpu](<https://devfeed.tech/tags/cpu.md>), [ebpf](<https://devfeed.tech/tags/ebpf.md>), [falco](<https://devfeed.tech/tags/falco.md>), [release](<https://devfeed.tech/tags/release.md>), [version](<https://devfeed.tech/tags/version.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

Falco 0.36.1 is a patch release that fixes a HIGH severity libcurl vulnerability, updates libcurl to version 8.4.0, improves legacy eBPF probe handling on systems with CPU hotplug enabled, removes an obsolete experimental configuration, and fixes a possible segmentation fault.

## Source excerpt

Today we announce the release of Falco 0.36.1 🦅! Fixes Falco's 0.36.1 release is a small patch aimed at protecting our uses by addressing a few minor bugs. It includes the following: Address a HIGH severity vulnerability in libcurl CVE-2023-38545, bumping the library to the patched version 8.4.0. You can find more details in the section below. The legacy eBPF probe can now handle systems with CPU hotplug enabled, opening the right number of kernel buffers. (https://github.com/falcosecurity/falco/issues/2843) Remove a no longer useful experimental Falco config outputs_queue.recovery. This was introduced in Falco 0.36.0 as an experiment. Fix a possible segfault caused by a faulty implementation of timer_delete. (https://github.com/falcosecurity/falco/issues/2850) Thanks to everyone in the community for helping us in spotting these annoying bugs 🐛! You make Falco successful 🦅! Thanks as always to the Falco maintainers for their support and effort during the entire release process. Vulnerability in libcurl A HIGH severity vulnerability in libcurl, CVE-2023-38545, was disclosed alongside a patched version (8.4.0). We would like to answer the main question you might have about it: Does it affect Falco? According to the excellent in-depth description of the bug, this can only be triggered if both conditions below are true: A SOCKS5 HTTP(S) proxy has been configured. This happens if you have set the standard environment variables that control proxy connections, such as http_proxy/https_proxy/no_proxy or libcurl-specific ones as indicated in the advisory or the libcurl documentation. An attacker controls the server that Falco is connecting to, namely the server configured to receive http_output or a custom prebuilt driver repository server, and the SOCKS5 proxy is "slow enough" to allow the attack to happen. While it may be rare that users have an exploitable environment, it's still a possibility. For this reason, Falco maintainers decided to ship this patch release 🦅 Try it