CVE-2026-11586

Analyzed Analyzed - Analysis Complete

Memory Exhaustion in cURL via WebSocket PING Flood

Publication date: 2026-07-03

Last updated on: 2026-07-07

Assigner: curl

Description

By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-03

Last Modified

2026-07-07

Generated

2026-07-23

AI Q&A

2026-07-03

EPSS Evaluated

2026-07-22

NVD

CVE-2026-11586

EUVD

EUVD-2026-41500

Affected Vendors & Products

Vendor	Product	Version / Range
haxx	curl	From 8.16.0 (inc) to 8.21.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-11586 is a vulnerability in curl versions 8.16.0 through 8.20.0 where curl automatically responds to WebSocket PING frames without limiting memory allocation for unacknowledged frames.

Because there is no upper bound on memory allocation, a malicious server can send rapid, sequential PING messages to curl, causing it to consume all available memory and potentially crash or fail.

This issue is categorized under CWE-770, which refers to allocation of resources without limits or throttling.

Detection Guidance

This vulnerability involves curl automatically responding to WebSocket PING frames, which can lead to memory exhaustion if a malicious server sends rapid, sequential PING messages.

Detection would involve monitoring for unusual or excessive WebSocket PING frames being received by curl, or observing memory usage spikes related to curl processes.

Specific commands to detect this vulnerability are not provided in the available resources.

Impact Analysis

This vulnerability can lead to memory exhaustion on systems running vulnerable versions of curl when connecting to a malicious WebSocket server.

As a result, curl or applications using libcurl may crash or fail due to running out of memory, potentially causing denial of service or instability in applications relying on curl.

Although curl eventually reports an "out of memory" error, other parts of the application may fail before this happens.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade curl to version 8.21.0 or later, where the issue is fixed.

Alternatively, you can apply a patch that addresses the vulnerability or disable the automatic response to WebSocket PING frames by using the CURLWS_NOAUTOPONG option.

Hi! I’m here to help you understand CVE-2026-11586. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70