---
id: "CVE-2026-107928"
kind: "vulnerability"
aliases: ["CVE-2026-107928"]
title: "curl: GnuTLS builds let a malicious WebSocket server leak memory"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["curl", "gnutls", "libcurl", "package", "websocket"]
not_affected_if: ["no-websocket-use", "openssl-backend", "trusted-servers-only"]
published_at: "2026-10-20T21:17:15+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T05:04:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107928", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# curl: GnuTLS builds let a malicious WebSocket server leak memory

When curl is built against GnuTLS, a malicious WebSocket server can trigger an out-of-bounds read after a blocked send, because GnuTLS reports more bytes sent than were given to it. An attacker who controls the server curl connects to can cause curl to send memory beyond its send buffer.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `curl --version` and look for GnuTLS in the features or SSL library line.
- Check whether any curl binary or libcurl on the host was built with GnuTLS rather than OpenSSL.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107928

## From the sources

When curl is built with GnuTLS, a malicious WebSocket server can make curl
send memory past its send buffer. This is due to an out of bounds read
following when `gnutls_record_send()` returns a number of bytes sent **greater
than the number of bytes it was given to send**. GnuTLS does that after a
blocked send.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_