Memory Exhaustion in cURL via WebSocket PING Flood

Executive Summary

CVE-2026-11586 is a vulnerability in curl versions 8.16.0 through 8.20.0 where curl automatically responds to WebSocket PING frames without limiting memory allocation for unacknowledged frames.

Because there is no upper bound on memory allocation, a malicious server can send rapid, sequential PING messages to curl, causing it to consume all available memory and potentially crash or fail.

This issue is categorized under CWE-770, which refers to allocation of resources without limits or throttling.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to memory exhaustion on systems running vulnerable versions of curl when connecting to a malicious WebSocket server.

As a result, curl or applications using libcurl may crash or fail due to running out of memory, potentially causing denial of service or instability in applications relying on curl.

Although curl eventually reports an "out of memory" error, other parts of the application may fail before this happens.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves curl automatically responding to WebSocket PING frames, which can lead to memory exhaustion if a malicious server sends rapid, sequential PING messages.

Detection would involve monitoring for unusual or excessive WebSocket PING frames being received by curl, or observing memory usage spikes related to curl processes.

Specific commands to detect this vulnerability are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade curl to version 8.21.0 or later, where the issue is fixed.

Alternatively, you can apply a patch that addresses the vulnerability or disable the automatic response to WebSocket PING frames by using the CURLWS_NOAUTOPONG option.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0