CURL-CVE-2026-11586: WS Auto-PONG memory exhaustion

Published Jul 3, 2026

Updated

By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.

Affected Software

1 affected component

curl curl

Event History

Jul 3, 2026

CVE Published

via OSV·06:13 AM

Data Sourced

via OSV·06:13 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which curl clients are exposed to this issue?

Clients that use curl's WebSocket functionality and connect to an untrusted or malicious WebSocket server are exposed. The automatic PONG behavior is enabled by default.

What does an attacker need to do to trigger the memory exhaustion?

An attacker only needs to operate or control a WebSocket server that the curl client connects to. The server can send rapid, sequential PING frames, causing memory consumption to grow through unacknowledged frames.

What is the impact of successful exploitation?

The malicious server can exhaust all available memory on the system running curl, resulting in a denial of service. No authentication, user interaction, confidentiality impact, or integrity impact is indicated by the provided severity vector.

CURL-CVE-2026-11586: WS Auto-PONG memory exhaustion

Affected Software

Event History

Frequently Asked Questions

Which curl clients are exposed to this issue?

What does an attacker need to do to trigger the memory exhaustion?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which curl clients are exposed to this issue?

What does an attacker need to do to trigger the memory exhaustion?

What is the impact of successful exploitation?