Sign In

CVE-2026-107928

ADVISORY - nist

Summary

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when gnutls_record_send() returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked send.

EPSS Score⁠: 0.00705 (0.534)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-126⁠

Buffer Over-read

Impacted images

Advisories

NIST

CREATED

UPDATED

ADVISORY IDCVE-2026-107928⁠
EXPLOITABILITY SCORE

2.2

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
CWE-126⁠

CVSS SCORE

8.1high

Alpine

CREATED

UPDATED

ADVISORY IDCVE-2026-107928⁠
EXPLOITABILITY SCORE

-

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
RATING UNAVAILABLE FROM ADVISORY

Debian

CREATED

UPDATED

ADVISORY IDCVE-2026-107928⁠
EXPLOITABILITY SCORE

-

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
RATING UNAVAILABLE FROM ADVISORY

Ubuntu

CREATED

UPDATED

ADVISORY IDCVE-2026-107928⁠
EXPLOITABILITY SCORE

-

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Alow

minimos

CREATED

UPDATED

ADVISORY ID

MINI-43r6-xcjc-qp32

EXPLOITABILITY SCORE

-

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
RATING UNAVAILABLE FROM ADVISORY