curl Unbounded WebSocket PING Memory Exhaustion
CVE-2026-11586 Published on July 3, 2026
WS Auto-PONG memory exhaustion
By default, curl automatically responds to WebSocket PING frames. Because curl
lacks an upper bound on memory allocation for unacknowledged frames, a
malicious server can exhaust all available memory by flooding curl with rapid,
sequential PING messages.
Products Associated with CVE-2026-11586
Want to know whenever a new CVE is published for Haxx Curl? stack.watch will email you.
Affected Versions
curl:- Version 8.20.0, <= 8.20.0 is affected.
- Version 8.19.0, <= 8.19.0 is affected.
- Version 8.18.0, <= 8.18.0 is affected.
- Version 8.17.0, <= 8.17.0 is affected.
- Version 8.16.0, <= 8.16.0 is affected.