CVE-2026-107928

Name of the Vulnerable Software and Affected Versions curl (affected versions not specified)

Description When built with GnuTLS, a malicious WebSocket server can cause curl to send memory beyond its send buffer. This occurs because of an out-of-bounds read that happens when the gnutls record send() function returns a number of bytes sent that exceeds the number of bytes it was originally instructed to send, typically following a blocked send.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.