{"id":"CVE-2026-11586","summary":"WS Auto-PONG memory exhaustion","details":"By default, curl automatically responds to WebSocket PING frames. Because curl\nlacks an upper bound on memory allocation for unacknowledged frames, a\nmalicious server can exhaust all available memory by flooding curl with rapid,\nsequential PING messages.","aliases":["CURL-CVE-2026-11586"],"modified":"2026-11-03T22:57:08.343529102Z","published":"2026-07-03T06:13:04.448Z","related":["SUSE-SU-2026:5068-1","SUSE-SU-2026:5069-1","openSUSE-SU-2026:11230-1"],"database_specific":{"cna_assigner":"curl","cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11586.json"},"references":[{"type":"WEB","url":"https://curl.se/docs/CVE-2026-11586.html"},{"type":"WEB","url":"https://curl.se/docs/CVE-2026-11586.json"},{"type":"WEB","url":"https://hackerone.com/reports/3788931"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11586.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11586"},{"type":"PACKAGE","url":"https://github.com/curl/curl.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/curl/curl","events":[{"introduced":"11b991232fbcaa88e2b1faecac224416b0001e35"},{"fixed":"68720b4837284335b2d63cb358f8f6ce65f5bc55"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*","range":[{"introduced":"8.16.0"},{"fixed":"8.21.0"}],"source":"CPE_RANGE"}]}},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"0b091328773c64e23f5c4739da74527093c6a5ab"},{"fixed":"849317ff5c5a5e13f50ec3d001e46ddffa77d8a4"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0b091328773c64e23f5c4739da74527093c6a5ab"},{"fixed":"849317ff5c5a5e13f50ec3d001e46ddffa77d8a4"}],"source":"AFFECTED_FIELD"}]}}],"versions":["8.16.0","8.17.0","8.18.0","8.19.0","8.20.0","rc-8_21_0-3","rc-8_21_0-2","rc-8_21_0-1","curl-8_20_0","rc-8_20_0-3","rc-8_20_0-2","rc-8_20_0-1","curl-8_19_0","curl-8_18_0","curl-8_17_0","curl-8_16_0","rc-8_19_0-3","rc-8_19_0-2","rc-8_19_0-1","rc-8_18_0-3","rc-8_18_0-2","rc-8_18_0-1"],"database_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://github.com/curl/curl.git/commit/849317ff5c5a5e13f50ec3d001e46ddffa77d8a4","target":{"file":"lib/ws.c","function":"ws_enc_add_cntrl"},"deprecated":false,"digest":{"function_hash":"148523427819478986185640703811775235750","length":547},"id":"CVE-2026-11586-716a9721","signature_type":"Function"},{"deprecated":false,"digest":{"length":1246,"function_hash":"38707464548119093148878866268571100978"},"id":"CVE-2026-11586-d19cf8f9","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/849317ff5c5a5e13f50ec3d001e46ddffa77d8a4","target":{"function":"ws_flush","file":"lib/ws.c"}},{"deprecated":false,"digest":{"function_hash":"152653730465138214257951274397922881871","length":1345},"id":"CVE-2026-11586-e10ab93f","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/849317ff5c5a5e13f50ec3d001e46ddffa77d8a4","target":{"function":"ws_cw_write","file":"lib/ws.c"}},{"source":"https://github.com/curl/curl.git/commit/849317ff5c5a5e13f50ec3d001e46ddffa77d8a4","target":{"file":"lib/ws.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["293447003980659176917234527467508611182","184333020907240303466394169148227369453","297792235032380559157923729860524131899","34215734356848894295068080973402626345","242575203789697467402831565613094054641","25887743304584439995215938468150252922","281894467210479228447560309550841676530","190663008595347900527559397672186726185","44443287644121014087903496253634657568","238018776025897558170169387945359714744","321858754205892765423867630624891243030","267534602929198096029553488892737581803","91821830427483098291952496218993783792","182442870708779635011973243033759177917","80158165353685967423849559156322094550","102239406834827656592309192200713103504","90512970073904278651767210372953135223","13008687535060876720328318729048355644","226501221663708122671910077025036996000","63296664067006173091319816889473904114","54142548748840883216012593019733887504","102968463275218497157981005314252961270","112033335776164373886715487042256163228","163032271653988957072147900544676185322","30019208279720072884252294566129214054","337455770035258984070860537195321149860","312650177316440713362850982928367942611","168478594837605450119258908671390163842","68228626452133810012227197464834869612","203650736056108616305718081764105483230","279180683152164507232149443536673522226","194656984258159220139661398690602800488","104310717983247557129376396257213955022"]},"id":"CVE-2026-11586-f4b8cf44","signature_type":"Line","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-24T14:18:28Z","source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-11586.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}