CVE-2026-107928
Fixed in a distro release EPSS <1%
When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was given to send**. GnuTLS does that after a blocked send.
Products: curl
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.23 | curl | 8.23.0-r0 |
| Alpine 3.24 | curl | 8.23.0-r0 |
| Debian 12 | curl | no fix |
| Debian 13 | curl | no fix |
| Debian 14 | curl | no fix |
| Red Hat hummingbird 1 | curl | 0:8.23.0-0.1.hum1 |
| Red Hat hummingbird 1 | libcurl | 0:8.23.0-0.1.hum1 |
| Red Hat hummingbird 1 | libcurl-devel | 0:8.23.0-0.1.hum1 |
| Red Hat hummingbird 1 | libcurl-minimal | 0:8.23.0-0.1.hum1 |
| Ubuntu 26.04 LTS | curl | 8.18.0-1ubuntu2.8 |
| Ubuntu 26.10 | curl | 8.20.0-2ubuntu11.1 |
| openSUSE Tumbleweed | curl | 8.23.0-1.1 |