CVE-2026-11586

HIGH 7.5

WS Auto-PONG memory exhaustion

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.

CWE	CWE-770
Vendor	curl
Product	curl
Published	Jul 3, 2026
Last Updated	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for curl curl

Be the first to know when new high vulnerabilities affecting curl curl are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

curl / curl

8.16.0 < 8.16.1 8.17.0 < 8.20.1

curl / curl

0b091328773c64e23f5c4739da74527093c6a5ab < 849317ff5c5a5e13f50ec3d001e46ddffa77d8a4

curl / curl

8.20.0 8.19.0 8.18.0 8.17.0 8.16.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

curl.se: https://curl.se/docs/CVE-2026-11586.json curl.se: https://curl.se/docs/CVE-2026-11586.html hackerone.com: https://hackerone.com/reports/3788931

Credits

evergarden1123 on hackerone (AntAISecurityLab) Stefan Eissing