CVE-2026-107928

Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Read in Curl with GnuTLS

Publication date: 2026-10-20

Last updated on: 2026-10-30

Assigner: curl

Description

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was given to send**. GnuTLS does that after a blocked send.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-107928

Affected Vendors & Products

Vendor	Product	Version / Range
curl	curl	8.22.0
curl	curl	8.21.0
curl	curl	8.20.0
curl	curl	8.19.0
curl	curl	8.18.0
curl	curl	8.17.0
curl	curl	8.16.0
curl	curl	8.15.0
curl	curl	8.14.1
curl	curl	8.14.0
curl	curl	8.13.0
curl	curl	8.12.1
curl	curl	8.12.0
curl	curl	8.11.1
curl	curl	8.11.0
curl	curl	8.10.1
curl	curl	8.10.0
curl	curl	8.9.1
curl	curl	8.9.0
curl	curl	8.8.0
curl	curl	8.7.1
curl	curl	8.7.0
curl	curl	8.6.0
curl	curl	8.5.0
curl	curl	8.4.0
curl	curl	8.3.0
curl	curl	8.2.1
curl	curl	8.2.0
curl	curl	8.1.2
curl	curl	8.1.1
curl	curl	8.1.0
curl	curl	8.0.1
curl	curl	8.0.0
curl	curl	7.88.1
curl	curl	7.88.0
curl	curl	7.87.0
curl	curl	7.86.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-126	The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Attack-Flow Graph

Executive Summary

This vulnerability occurs when curl is built with GnuTLS. A malicious WebSocket server can exploit it by making curl send memory beyond its intended buffer. This happens because GnuTLS may return a number of bytes sent that exceeds the bytes it was asked to send, particularly after a blocked send operation.

Detection Guidance

This vulnerability is specific to curl built with GnuTLS and involves an out-of-bounds read when sending WebSocket data. Detection requires checking curl version and GnuTLS configuration. No direct commands are provided in the context, but monitoring for memory corruption or unexpected network behavior during WebSocket operations may help.

Impact Analysis

This vulnerability could allow an attacker to read or leak sensitive memory from the curl process. If curl is used in applications handling sensitive data, this could lead to information disclosure or potential further exploitation.

Mitigation Strategies

Update curl to the latest version where this issue is patched. If using GnuTLS, consider switching to a different TLS backend like OpenSSL if possible. Monitor network traffic for unusual WebSocket connections.

Hi! I’m here to help you understand CVE-2026-107928. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...