CVE-2026-11586

By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.

Scoring

Severity

HIGH

CVSS base score

7.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS probability

0.61%

CWE

CWE-770

Published

2026-07-03

Last modified

2026-09-17

Affected products

• curl curl
• curl curl
• curl curl
• curl curl
• curl curl
• curl curl

Weakness type

• CWE-770

Related vulnerabilities

• CVE-2026-1168 — Allocation of Resources Without Limits or Throttling in GitLab
• CVE-2025-14871 — Allocation of Resources Without Limits or Throttling in GitLab
• CVE-2026-88878 — Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass
• CVE-2026-82439 — Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC
• CVE-2026-72684 — Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
• CVE-2026-74878 — openssl_encrypt before 1.4.0 TOTP Rate Limiter Bypass
• CVE-2026-77337 — CakePHP: Potential Authentication bypass with CookieAuthenticator
• CVE-2026-79921 — amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload

Markdown version · Browse all CVEs