{"id":"CVE-2026-107928","kind":"vulnerability","aliases":["CVE-2026-107928"],"related":[],"title":"curl: GnuTLS builds let a malicious WebSocket server leak memory","description":"When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send.","summary":"When curl is built against GnuTLS, a malicious WebSocket server can trigger an out-of-bounds read after a blocked send, because GnuTLS reports more bytes sent than were given to it. An attacker who controls the server curl connects to can cause curl to send memory beyond its send buffer.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["curl","gnutls","libcurl","package","websocket"],"not_affected_if":["no-websocket-use","openssl-backend","trusted-servers-only"],"how_to_check":"- Run `curl --version` and look for GnuTLS in the features or SSL library line.\n- Check whether any curl binary or libcurl on the host was built with GnuTLS rather than OpenSSL.","fix":null,"status":"open","published_at":"2026-10-20T21:17:15+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:33+00:00","updated_at":"2026-10-25T05:04:33+00:00","category":"package","confidence":0.55,"triage":{"at":"2026-10-25T05:04:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"curl: GnuTLS builds let a malicious WebSocket server leak memory","impact":"medium","summary":"When curl is built against GnuTLS, a malicious WebSocket server can trigger an out-of-bounds read after a blocked send, because GnuTLS reports more bytes sent than were given to it. An attacker who controls the server curl connects to can cause curl to send memory beyond its send buffer.","category":"package","nicknames":[],"who_cares":["curl","libcurl","websocket","gnutls"],"confidence":0.55,"needs_auth":"unknown","worst_case":"curl sends adjacent process memory to a malicious WebSocket server","analyst_note":"Sources give no fixed version or patch; check the curl security advisory for the affected and fixed versions and the exact memory impact.","how_to_check":"- Run `curl --version` and look for GnuTLS in the features or SSL library line.\n- Check whether any curl binary or libcurl on the host was built with GnuTLS rather than OpenSSL.","needs_analyst":true,"not_affected_if":["openssl-backend","no-websocket-use","trusted-servers-only"],"who_is_affected":"Only curl builds that use GnuTLS as their TLS backend and that connect over WebSocket to servers the team does not control. Builds using OpenSSL, mbedTLS or other backends are not described as affected by the sources.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000596,"input_tokens":3315,"output_tokens":529,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107928':13A,16A '-2026':12A,15A 'attack':56B 'beyond':70B 'block':42B,129C 'bound':38B,100C 'buffer':73B,92C 'build':3A 'built':25B,77C 'byte':48B,111C,118C 'caus':65B 'connect':62B 'control':58B 'curl':1A,17B,23B,61B,66B,75C,86C 'cve':11A,14A 'due':95C 'follow':102C 'given':52B,121C 'gnutl':2A,18B,27B,45B,79C,104C,124C 'greater':113C 'leak':9A 'let':4A 'libcurl':19B 'make':85C 'malici':6A,29B,81C 'memori':10A,69B,88C 'number':109C,116C 'out-of-bound':35B 'packag':20B 'past':89C 'read':39B,101C 'record':105C 'report':46B 'return':107C 'send':43B,68B,72B,87C,91C,106C,123C,130C 'sent':49B,112C 'server':8A,31B,60B,83C 'trigger':33B 'websocket':7A,21B,30B,82C","nicknames":[],"mitigations":[],"who_affected":"Only curl builds that use GnuTLS as their TLS backend and that connect over WebSocket to servers the team does not control. Builds using OpenSSL, mbedTLS or other backends are not described as affected by the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107928","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107928","severity":null,"published_at":"2026-10-20T21:17:15+00:00","modified_at":"2026-10-22T16:57:53+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}