curl: Out-of-bounds read in WebSocket upload with GnuTLS backend

Summary

A malicious WebSocket server can make curl read memory beyond its send buffer when curl is built with the GnuTLS TLS backend. The trigger is a blocked TLS send followed by an automatic WebSocket PONG response, and the worst case is leaking data from a neighboring heap buffer to the server. The flaw is more likely to cause a crash, and the official severity is Low.

Affected

• curl 7.86.0 to and including 8.22.0 when built with GnuTLS
• Only the GnuTLS backend is affected; builds with other TLS backends are not affected
• The command line tool and libcurl are both affected
• Not affected: 8.23.0 and later, 8.20.2 and later in the 8.20.X branch, 8.16.2 and later in the 8.16.X branch, 8.14.3 and later in the 8.14.X branch
• Distribution packages may differ; the CVSS 8.1 in the intake data could not be verified

Fixed in

• curl 8.23.0 (released October 14, 2026)
• Upstream commit 64fb3e7a7b116f690966054f281624152d4a7651
• Ubuntu 26.10: curl 8.20.0-2ubuntu11.1 (USN-8927-2)
• openSUSE Tumbleweed: curl 8.23.0-1.1
• Debian: sid fixed in 8.23.0-1; bookworm and trixie still listed as vulnerable (trixie marked no-dsa)
• Red Hat, Alpine and Windows/vendor builds: Unknown; check the vendor advisory

Workaround

• Use a TLS backend other than GnuTLS for WebSocket connections, if you build curl yourself
• Restrict WebSocket use to trusted endpoints
• Apply the upstream patch to your local build if an update is not yet available

Exploitation

• CISA SSVC: exploitation status poc, not automatable, total technical impact
• SUSE reports it as not known to be exploited
• No CISA KEV listing found; EPSS about 0.0026 (very low)
• No confirmed public proof of concept known

Our recommendation

• Check whether curl or libcurl is installed in a GnuTLS build (for example libcurl3t64-gnutls on Ubuntu)
• Update to curl 8.23.0 or the distribution's fixed package; check your distribution's tracker for trixie or bookworm if no fix is available
• Where no update is possible, switch the TLS backend or limit WebSocket connections to trusted servers
• Prioritize hosts and build pipelines that use curl WebSocket against external endpoints
• Re-check NVD once analysis is complete and raise priority if the vendor severity changes

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• curl security advisory CVE-2026-107928 curl.se
• curl CVE JSON metadata curl.se
• Original HackerOne report hackerone.com
• Debian security tracker security-tracker.debian.org
• Ubuntu USN-8927-2 ubuntu.com
• OSV CURL-CVE-2026-107928 osv.dev
• Vulners NVD CVE-2026-107928 vulners.com
• curl security policy curl.se

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:36.