CVE-2026-107928

info leak uploading over WebSockets with GnuTLS

View on CVE.org
Published Oct 20, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Description
When curl is built with GnuTLS, a malicious WebSocket server can make curl
send memory past its send buffer. This is due to an out of bounds read
following when `gnutls_record_send()` returns a number of bytes sent **greater
than the number of bytes it was given to send**. GnuTLS does that after a
blocked send.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Ubuntu USN Ubuntu USN USN-8927-1 curl vulnerabilities
Ubuntu USN Ubuntu USN USN-8927-2 curl vulnerabilities
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
Description A flaw was found in curl. When curl is built with the GnuTLS library, a blocked transmission during communication with a malicious WebSocket server can trigger an out-of-bounds memory read. A malicious server can exploit this flaw to expose sensitive data from neighboring memory buffers or crash the client, leading to information disclosure or a Denial of Service (DoS). When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was given to send**. GnuTLS does that after a blocked send.
Title curl: curl: info leak uploading over WebSockets with GnuTLS info leak uploading over WebSockets with GnuTLS
References
Type Values Removed Values Added
First Time appeared Curl
Curl curl
Vendors & Products Curl
Curl curl
Type Values Removed Values Added
Description A flaw was found in curl. When curl is built with the GnuTLS library, a blocked transmission during communication with a malicious WebSocket server can trigger an out-of-bounds memory read. A malicious server can exploit this flaw to expose sensitive data from neighboring memory buffers or crash the client, leading to information disclosure or a Denial of Service (DoS).
Title curl: curl: info leak uploading over WebSockets with GnuTLS
Weaknesses CWE-126
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L'}

threat_severity

Low
Weaknesses

Sources

Status
PUBLISHED
Assigner
curl
Published
Updated
Oct 30, 2026, 4:26 PM
Reserved
Oct 9, 2026, 7:51 AM

View source JSON

Updated
Oct 30, 2026, 4:25 PM

JSON

Status
Awaiting Analysis
Published
Oct 20, 2026, 9:17 PM
Modified
Oct 30, 2026, 5:17 PM

View source JSON

Severity
Low
Public date
Oct 14, 2026, 12:00 PM

View source Bugzilla JSON

Updated
Oct 30, 2026, 6:30 PM

JSON