Live › vulnerability › CVE-2026-107928
Go to dashboardWhen curl is built against GnuTLS, a malicious WebSocket server can trigger an out-of-bounds read after a blocked send, because GnuTLS reports more bytes sent than were given to it. An attacker who controls the server curl connects to can cause curl to send memory beyond its send buffer.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only curl builds that use GnuTLS as their TLS backend and that connect over WebSocket to servers the team does not control. Builds using OpenSSL, mbedTLS or other backends are not described as affected by the sources.
No product ranges from the sources yet.
curl --version and look for GnuTLS in the features or SSL library line.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When curl is built with GnuTLS, a malicious WebSocket server can make curl
send memory past its send buffer. This is due to an out of bounds read
following when gnutls_record_send() returns a number of bytes sent greater
than the number of bytes it was given to send. GnuTLS does that after a
blocked send.
This page as .md · .json · in your agent: get_signal("CVE-2026-107928")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.