When curl is built with GnuTLS, a malicious WebSocket server can make curl
send memory past its send buffer. This is due to an out of bounds read
following when `gnutls_record_send()` returns a number of bytes sent **greater
than the number of bytes it was given to send**. GnuTLS does that after a
blocked send.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Curl |
|
No data.
No data.
References
History
Tue, 20 Oct 2026 20:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in curl. When curl is built with the GnuTLS library, a blocked transmission during communication with a malicious WebSocket server can trigger an out-of-bounds memory read. A malicious server can exploit this flaw to expose sensitive data from neighboring memory buffers or crash the client, leading to information disclosure or a Denial of Service (DoS). | When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was given to send**. GnuTLS does that after a blocked send. |
| Title | curl: curl: info leak uploading over WebSockets with GnuTLS | info leak uploading over WebSockets with GnuTLS |
| References |
|
Sat, 17 Oct 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Curl
Curl curl |
|
| Vendors & Products |
Curl
Curl curl |
Sat, 17 Oct 2026 00:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in curl. When curl is built with the GnuTLS library, a blocked transmission during communication with a malicious WebSocket server can trigger an out-of-bounds memory read. A malicious server can exploit this flaw to expose sensitive data from neighboring memory buffers or crash the client, leading to information disclosure or a Denial of Service (DoS). | |
| Title | curl: curl: info leak uploading over WebSockets with GnuTLS | |
| Weaknesses | CWE-126 | |
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: curl
Published: 2026-10-20T20:28:17.712Z
Updated: 2026-10-20T20:28:17.712Z
Reserved: 2026-10-09T07:51:36.688Z
Link: CVE-2026-107928
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-10-20T21:17:15.470
Modified: 2026-10-22T16:57:53.407
Link: CVE-2026-107928
Redhat