CVE-2026-11586

HighCVSS 7.5/10Last modified Sep 15, 2026

Description

By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
curl	curl	>= 8.16.0, < 8.16.1; >= 8.17.0, < 8.20.1
curl	curl	>= 0b091328773c64e23f5c4739da74527093c6a5ab, < 849317ff5c5a5e13f50ec3d001e46ddffa77d8a4
curl	curl	8.20.0; 8.19.0; 8.18.0; 8.17.0; 8.16.0

References

https://curl.se/docs/CVE-2026-11586.htmlPatch, Vendor Advisory
https://curl.se/docs/CVE-2026-11586.jsonVendor Advisory
https://hackerone.com/reports/3788931Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Jul 3, 2026
Last modified: Sep 15, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-1158637.6ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a CVE-2026-1158647.5Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request CVE-2026-1158657.5Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request b CVE-2026-1158667.5Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodie CVE-2026-1158696.4The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font (tb CVE-2026-115877.2SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database CVE-2026-1158712.7The WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups plugin for WordPress is vulnerable to Arbitr CVE-2026-1158775.4Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.hea CVE-2026-1158787.8Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until CVE-2026-115886.1The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML CVE-2026-1158836.0LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-che CVE-2026-1158854.1The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a tempor