Out-of-Bounds Memory Issue in Curl with GnuTLS

CVE-2026-107928

What is CVE-2026-107928?

A vulnerability in Curl's implementation with GnuTLS allows a malicious WebSocket server to exploit an out-of-bounds read condition. This occurs when gnutls_record_send() returns a number of bytes greater than the designated send buffer, potentially leading to unauthorized memory access and data leakage. Users should ensure their implementations are secure and updated to mitigate this vulnerability.

References