info leak uploading over WebSockets with GnuTLS
Impact
When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when gnutls_record_send() returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked send.
Source excerpt · curlAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
curl · curl
curl
37 ranges
curl · curl
curl
Compare with this publisher’s ranges. This does not inspect your installation.
affected
8.22.0 → through 8.22.0
semver versions
8.21.0 → through 8.21.0
semver versions
8.20.0 → through 8.20.0
semver versions
8.19.0 → through 8.19.0
semver versions
8.18.0 → through 8.18.0
semver versions
8.17.0 → through 8.17.0
semver versions
8.16.0 → through 8.16.0
semver versions
8.15.0 → through 8.15.0
semver versions
8.14.1 → through 8.14.1
semver versions
8.14.0 → through 8.14.0
semver versions
8.13.0 → through 8.13.0
semver versions
8.12.1 → through 8.12.1
semver versions
8.12.0 → through 8.12.0
semver versions
8.11.1 → through 8.11.1
semver versions
8.11.0 → through 8.11.0
semver versions
8.10.1 → through 8.10.1
semver versions
8.10.0 → through 8.10.0
semver versions
8.9.1 → through 8.9.1
semver versions
8.9.0 → through 8.9.0
semver versions
8.8.0 → through 8.8.0
semver versions
8.7.1 → through 8.7.1
semver versions
8.7.0 → through 8.7.0
semver versions
8.6.0 → through 8.6.0
semver versions
8.5.0 → through 8.5.0
semver versions
8.4.0 → through 8.4.0
semver versions
8.3.0 → through 8.3.0
semver versions
8.2.1 → through 8.2.1
semver versions
8.2.0 → through 8.2.0
semver versions
8.1.2 → through 8.1.2
semver versions
8.1.1 → through 8.1.1
semver versions
8.1.0 → through 8.1.0
semver versions
8.0.1 → through 8.0.1
semver versions
8.0.0 → through 8.0.0
semver versions
7.88.1 → through 7.88.1
semver versions
7.88.0 → through 7.88.0
semver versions
7.87.0 → through 7.87.0
semver versions
7.86.0 → through 7.86.0
semver versions
Other versions: unaffected
Original source description
When curl is built with GnuTLS, a malicious WebSocket server can make curl
send memory past its send buffer. This is due to an out of bounds read
following when gnutls_record_send() returns a number of bytes sent greater
than the number of bytes it was given to send. GnuTLS does that after a
blocked send.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-107928View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.