send memory past its send buffer. This is due to an out of bounds read
following when `gnutls_record_send()` returns a number of bytes sent **greater
than the number of bytes it was given to send**. GnuTLS does that after a
blocked send.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| curl | curl | unaffected |
|
No data.
No data.
| Vendor | Product | Confidence | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Curl | Curl | 80% |
|
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 Ubuntu USN |
USN-8927-1 | curl vulnerabilities |
| Ubuntu USN |
USN-8927-2 | curl vulnerabilities |
Tue, 20 Oct 2026 20:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in curl. When curl is built with the GnuTLS library, a blocked transmission during communication with a malicious WebSocket server can trigger an out-of-bounds memory read. A malicious server can exploit this flaw to expose sensitive data from neighboring memory buffers or crash the client, leading to information disclosure or a Denial of Service (DoS). | When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was given to send**. GnuTLS does that after a blocked send. |
| Title | curl: curl: info leak uploading over WebSockets with GnuTLS | info leak uploading over WebSockets with GnuTLS |
| References |
|
Sat, 17 Oct 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Curl
Curl curl |
|
| Vendors & Products |
Curl
Curl curl |
Sat, 17 Oct 2026 00:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in curl. When curl is built with the GnuTLS library, a blocked transmission during communication with a malicious WebSocket server can trigger an out-of-bounds memory read. A malicious server can exploit this flaw to expose sensitive data from neighboring memory buffers or crash the client, leading to information disclosure or a Denial of Service (DoS). | |
| Title | curl: curl: info leak uploading over WebSockets with GnuTLS | |
| Weaknesses | CWE-126 | |
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: curl
Published:
Updated: 2026-10-20T20:28:17.712Z
Reserved: 2026-10-09T07:51:36.688Z
Link: CVE-2026-107928
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-10-20T21:17:15.470
Modified: 2026-10-22T16:57:53.407
Link: CVE-2026-107928
Redhat
OpenCVE Enrichment
Updated: 2026-10-20T22:45:17Z