info leak uploading over WebSockets with GnuTLS
===============================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-107928.html)

VULNERABILITY
-------------

When curl is built with GnuTLS, a malicious WebSocket server can make curl
send memory past its send buffer. This is due to an out of bounds read
following when `gnutls_record_send()` returns a number of bytes sent **greater
than the number of bytes it was given to send**. GnuTLS does that after a
blocked send.

INFO
----

The problem triggers when a send over TLS first reaches an `EAGAIN` situation
and is followed by an automated WebSocket `PONG` response.

This problem only triggers when curl uses the GnuTLS backend.

In the worst case, this bug sends data from a neighboring heap buffer to the
server in a subsequent send call, but it also likely to just crash.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-107928 to this issue.

CWE-126: Buffer Over-read

Severity: Low

This bug is considered a *C mistake* (likely to have been avoided had we not
been using C).

AFFECTED VERSIONS
-----------------

- Affected versions: curl 7.86.0 to and including 8.22.0
- Not affected versions: curl < 7.86.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/664249d095275ec532f5

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION
--------

- Fixed-in: https://github.com/curl/curl/commit/64fb3e7a7b116f6909660

RECOMMENDATIONS
---------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - using another TLS backend when doing WebSocket

TIMELINE
--------

This issue was reported to the curl project on October 9, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Luna with Claude, Anthropic
- Patched-by: Stefan Eissing

Thanks a lot!