8.1
High
CVE-2026-107928 When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer
Description
When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was given to send**. GnuTLS does that after a blocked send.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| curl | 8.22.0 | No fix stated |
| curl | 8.21.0 | No fix stated |
| curl | 8.20.0 | No fix stated |
| curl | 8.19.0 | No fix stated |
| curl | 8.18.0 | No fix stated |
| curl | 8.17.0 | No fix stated |
| curl | 8.16.0 | No fix stated |
| curl | 8.15.0 | No fix stated |
| curl 8.14 | 8.14.0 → 8.14.1 | No fix stated |
Show the 17 other branches Hide the 17 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| curl | 8.13.0 | No fix stated |
| curl 8.12 | 8.12.0 → 8.12.1 | No fix stated |
| curl 8.11 | 8.11.0 → 8.11.1 | No fix stated |
| curl 8.10 | 8.10.0 → 8.10.1 | No fix stated |
| curl 8.9 | 8.9.0 → 8.9.1 | No fix stated |
| curl | 8.8.0 | No fix stated |
| curl 8.7 | 8.7.0 → 8.7.1 | No fix stated |
| curl | 8.6.0 | No fix stated |
| curl | 8.5.0 | No fix stated |
| curl | 8.4.0 | No fix stated |
| curl | 8.3.0 | No fix stated |
| curl 8.2 | 8.2.0 → 8.2.1 | No fix stated |
| curl 8.1 | 8.1.0 → 8.1.2 | No fix stated |
| curl 8.0 | 8.0.0 → 8.0.1 | No fix stated |
| curl 7.88 | 7.88.0 → 7.88.1 | No fix stated |
| curl | 7.87.0 | No fix stated |
| curl | 7.86.0 | No fix stated |
Other CVEs of curl
The 98 CVEs of curl →
CVE-2026-107929
When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes…
8.1
High
CVE-2026-94266
libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing…
7.5
High
CVE-2026-94265
When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might…
9.1
Critical
CVE-2026-92391
A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal…
7.5
High