CVE-2026-11586

HighCVSS 7.5/10Last modified Sep 15, 2026

Description

By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
curl	curl	>= 8.16.0, < 8.16.1; >= 8.17.0, < 8.20.1
curl	curl	>= 0b091328773c64e23f5c4739da74527093c6a5ab, < 849317ff5c5a5e13f50ec3d001e46ddffa77d8a4
curl	curl	8.20.0; 8.19.0; 8.18.0; 8.17.0; 8.16.0

References

https://curl.se/docs/CVE-2026-11586.htmlPatch, Vendor Advisory
https://curl.se/docs/CVE-2026-11586.jsonVendor Advisory
https://hackerone.com/reports/3788931Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Jul 3, 2026
Last modified: Sep 15, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-1158637.6ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a CVE-2026-1158775.4Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.hea CVE-2026-115886.1The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML CVE-2026-1158836.0LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-che CVE-2026-1158854.1The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a tempor CVE-2026-1158866.5MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0 CVE-2026-1158877.5GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhone CVE-2026-1158899.9Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that CVE-2026-115898.8The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not properly validate uploaded files, allowing unauthentica CVE-2026-1158925.7Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a CVE-2026-1158939.9Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br CVE-2026-1158958.8Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom