CVE-2026-107928
Published: October 17, 2026Last modified: October 21, 2026
Description
When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was given to send**. GnuTLS does that after a blocked send.
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | curl | Not affected (8.1.0-r2) |
| 25 LTS | curl | Not affected (8.14.0-r1) | |
| Stream | curl | Not affected (8.1.2-r0) | |
| Hardened Containers | Stream | curl | Not affected (8.1.2-r0) |