CVE-2026-107928 curl CVE debrief

Who should care

Defenders responsible for curl deployments, particularly those using GnuTLS, should assess exposure and verify affected versions. This includes operators of WebSocket servers, as well as security teams and vulnerability management teams. The vulnerability affects curl when built with GnuTLS, which is a common configuration. Defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-107928 is an information leak vulnerability in curl when built with GnuTLS. Defenders should verify affected versions, assess exposure, and consider upgrading to a fixed version.

• Verify affected versions of curl to prioritize patching
• Assess exposure to WebSocket servers to prevent potential information leaks

Technical summary

The vulnerability occurs when curl is built with GnuTLS and a malicious WebSocket server can make curl send memory past its send buffer, resulting in an out-of-bounds read. This is due to the way GnuTLS handles the WebSocket protocol, specifically when `gnutls_record_send()` returns a number of bytes sent greater than the number of bytes it was given to send. The vulnerability can be exploited by a malicious WebSocket server to leak sensitive information from the curl process. Defenders should prioritize verifying affected versions of curl and assessing exposure in their environments.

Defensive priority

Defenders should prioritize verifying affected versions of curl and assessing exposure in their environments.

Recommended defensive actions

• Verify affected versions of curl in your environment
• Assess exposure to WebSocket servers
• Consider upgrading to a fixed version of curl
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional verification is needed to confirm affected versions and potential impact. The vulnerability is caused by an out-of-bounds read in the GnuTLS library, which is used by curl for secure communication. The issue is not specific to curl, but rather a vulnerability in the GnuTLS library that affects curl when built with it. Evidence of exploitation has not been reported, but defenders should verify affected versions and assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.