{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11586", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "state": "PUBLISHED", "assignerShortName": "curl", "dateReserved": "2026-06-08T12:17:42.037Z", "datePublished": "2026-07-03T06:13:04.448Z", "dateUpdated": "2026-07-03T06:13:04.448Z"}, "containers": {"cna": {"title": "WS Auto-PONG memory exhaustion", "descriptions": [{"lang": "en", "value": "By default, curl automatically responds to WebSocket PING frames. Because curl\nlacks an upper bound on memory allocation for unacknowledged frames, a\nmalicious server can exhaust all available memory by flooding curl with rapid,\nsequential PING messages."}], "providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-07-03T06:13:04.448Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"version": "8.20.0", "status": "affected", "lessThanOrEqual": "8.20.0", "versionType": "semver"}, {"version": "8.19.0", "status": "affected", "lessThanOrEqual": "8.19.0", "versionType": "semver"}, {"version": "8.18.0", "status": "affected", "lessThanOrEqual": "8.18.0", "versionType": "semver"}, {"version": "8.17.0", "status": "affected", "lessThanOrEqual": "8.17.0", "versionType": "semver"}, {"version": "8.16.0", "status": "affected", "lessThanOrEqual": "8.16.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-11586.json", "name": "json"}, {"url": "https://curl.se/docs/CVE-2026-11586.html", "name": "www"}, {"url": "https://hackerone.com/reports/3788931", "name": "issue"}], "credits": [{"lang": "en", "value": "evergarden1123 on hackerone (AntAISecurityLab)", "type": "finder"}, {"lang": "en", "value": "Stefan Eissing", "type": "remediation developer"}]}}}

{}

{}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.20.0,8.20.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.19.0,8.19.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.18.0,8.18.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.17.0,8.17.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.16.0,8.16.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "curl", "source": "cna", "vendor": "curl"}, "product": "curl", "vendor": "curl"}], "created": "2026-07-03T07:30:09.153921+00:00", "updated": "2026-07-03T07:30:09.153949+00:00", "vendors": ["curl", "curl$PRODUCT$curl"]}