CVE-2026-11586

By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.

• curl 8.21.0~rc3-1 [trixie] - curl (Vulnerable code not present) [bookworm] - curl (Vulnerable code not present) [bullseye] - curl (Vulnerable code not present) https://curl.se/docs/CVE-2026-11586.html Introduced with: https://github.com/curl/curl/commit/0b091328773c64e23f5c4739da74527093c6a5ab (curl-8_16_0) Fixed by: https://github.com/curl/curl/commit/849317ff5c5a5e13f50ec3d001e46ddffa77d8a4 (rc-8_21_0-3, curl-8_21_0)