CVE-2026-107928: info leak uploading over WebSockets with GnuTLS
When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when gnutlsrecordsend() returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked send.
Affected Software
Event History
Frequently Asked Questions
Which curl deployments are exposed?
The issue affects curl builds that use GnuTLS and upload data over WebSockets. Exploitation requires communicating with a malicious WebSocket server.
What condition triggers the out-of-bounds read?
The condition occurs after a blocked send when gnutls_record_send() reports that it sent more bytes than curl supplied. Curl can then transmit memory beyond its intended send buffer.
What information could be exposed?
The disclosed data is memory located past curl's send buffer. The provided information does not identify what specific data may occupy that memory.