UBUNTU-CVE-2026-107928: Low severity ubuntu/curl vulnerability

Q: Which curl deployments are affected?

The issue applies to curl builds that use GnuTLS. The affected interaction is with a WebSocket server.

Q: What does an attacker need to trigger the issue?

An attacker needs to control or operate a malicious WebSocket server that curl connects to. Exploitation depends on GnuTLS returning a sent-byte count larger than the buffer length after a blocked send.

Published Oct 14, 2026

Updated

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when gnutlsrecordsend() returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked send.

Affected Software

2 affected componentsFixes available

ubuntu/curl<8.20.0-2ubuntu11.1

8.20.0-2ubuntu11.1

ubuntu/curl<8.18.0-1ubuntu2.8

8.18.0-1ubuntu2.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/curl to a version that resolves this vulnerability.
Fixed in 8.20.0-2ubuntu11.1
Upgrade
Upgrade ubuntu/curl to a version that resolves this vulnerability.
Fixed in 8.18.0-1ubuntu2.8

Event History

Oct 14, 2026

CVE Published

via OSV·06:00 AM

Data Sourced

via OSV·06:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which curl deployments are affected?

The issue applies to curl builds that use GnuTLS. The affected interaction is with a WebSocket server.

What does an attacker need to trigger the issue?

An attacker needs to control or operate a malicious WebSocket server that curl connects to. Exploitation depends on GnuTLS returning a sent-byte count larger than the buffer length after a blocked send.

UBUNTU-CVE-2026-107928: Low severity ubuntu/curl vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which curl deployments are affected?

What does an attacker need to trigger the issue?

Company

Resources

Contact

Frequently Asked Questions

Which curl deployments are affected?

What does an attacker need to trigger the issue?