Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-11586

WS Auto-PONG memory exhaustion

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
curl

Description

By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

curl curl

Default version status: unaffected

  • 8.16.0 to < 8.16.1affected
  • 8.17.0 to < 8.20.1affected

curl curl

Default version status: unaffected

  • 0b091328773c64e23f5c4739da74527093c6a5ab to < 849317ff5c5a5e13f50ec3d001e46ddffa77d8a4affected

curl curl

Default version status: unaffected

  • 8.20.0affected
  • 8.19.0affected
  • 8.18.0affected
  • 8.17.0affected
  • 8.16.0affected

References