CVE-2026-107928

Published: Ott 20, 2026 Last Modified: Ott 20, 2026
ExploitDB:
Other exploit source:
Google Dorks:

Description

AI Translation Available

When curl is built with GnuTLS, a malicious WebSocket server can make curl
send memory past its send buffer. This is due to an out of bounds read
following when `gnutls_record_send()` returns a number of bytes sent **greater
than the number of bytes it was given to send**. GnuTLS does that after a
blocked send.

https://curl.se/docs/CVE-2026-107928.html
https://curl.se/docs/CVE-2026-107928.html
https://curl.se/docs/CVE-2026-107928.json
https://curl.se/docs/CVE-2026-107928.json
https://hackerone.com/reports/4099194
https://hackerone.com/reports/4099194