CVE-2026-11586: WS Auto-PONG memory exhaustion
By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.74.0-1.3+deb11u13Fixed in 7.74.0-1.3+deb11u16Fixed in 7.88.1-10+deb12u14Fixed in 7.88.1-10+deb12u5Fixed in 8.14.1-2+deb13u3Fixed in 8.21.0-2 - Configuration
Disable curl’s default automatic WebSocket PONG responses (auto-PONG) to prevent memory exhaustion caused by unacknowledged frame buffering when a malicious server floods rapid sequential PING messages.
curl WebSocket client WebSocket auto-PONG behavior = disable (do not automatically respond to WebSocket PING frames)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11586?
CVE-2026-11586 has a risk score of 28, indicating a significant potential for memory exhaustion.
How do I fix CVE-2026-11586?
To mitigate CVE-2026-11586, you should configure curl to limit memory allocation or disable automatic PONG responses to PING frames.
What type of attack does CVE-2026-11586 enable?
CVE-2026-11586 allows a malicious server to execute a denial of service attack by sending rapid PING messages to exhaust memory.
Which software is affected by CVE-2026-11586?
CVE-2026-11586 affects the curl command-line tool and library that handles HTTP requests.
When was CVE-2026-11586 published?
CVE-2026-11586 was published on July 3, 2026.