CVE-2026-107928
info leak uploading over WebSockets with GnuTLS
Project curl Security Advisory, October 14 2026 Permalink
VULNERABILITY
When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when gnutls_record_send() returns a number of bytes sent greater than the number of bytes it was given to send.
GnuTLS does that after a blocked send.
INFO
The problem triggers when a send over TLS first reaches an EAGAIN situation and is followed by an automated WebSocket PONG response.
This problem only triggers when curl uses the GnuTLS backend.
In the worst case, this bug sends data from a neighboring heap buffer to the server in a subsequent send call, but it also likely to instead crash.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-107928 to this issue.
CWE-126: Buffer Over-read
Severity: Low
This bug is considered a C mistake (likely to have been avoided had we not been using C).
AFFECTED VERSIONS
- Affected versions: curl 7.86.0 to and including 8.22.0
- Not affected versions: curl < 7.86.0 and >= 8.23.0
- Not affected versions: curl >= 8.20.2 in the 8.20.X branch
- Not affected versions: curl >= 8.16.2 in the 8.16.X branch
- Not affected versions: curl >= 8.14.3 in the 8.14.X branch
- Introduced-in: https://github.com/curl/curl/commit/664249d095275ec532f5
libcurl is used by many applications, but not always advertised as such!
This flaw also affects the curl command line tool.
SOLUTION
RECOMMENDATIONS
A - Upgrade curl to version 8.23.0
B - Apply the patch to your local version
C - using another TLS backend when doing WebSocket
TIMELINE
This issue was reported to the curl project on October 9, 2026.
curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.
CREDITS
- Reported-by: Luna with Claude, Anthropic
- Patched-by: Stefan Eissing
Thanks a lot!