CVE-2026-11586

Published: July 2, 2026Last modified: July 6, 2026

Description

By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.

Status

Product	Release	Package	Status
Alpaquita Linux	23 LTS	curl	Fixed (8.21.0-r0)
Alpaquita Linux	Stream	curl	Fixed (8.21.0-r0)
Hardened Containers	Stream	curl	Fixed (8.21.0-r0)

References

https://curl.se/docs/CVE-2026-11586.html
https://curl.se/docs/CVE-2026-11586.json
https://hackerone.com/reports/3788931

How to Fix Liberica NIK Not Starting on macOS Catalina and Later

If you use macOS Catalina and later you may encounter the issue that prevents Liberica NIK from starting. To fix it, run the following:

sudo xattr -r -d com.apple.quarantine path/to/graalvm/folder/

If you need more help, check out the FAQ at the bottom of this page or contact us.