{"id":"CVE-2026-11586","title":"By default, curl automatically responds to WebSocket PING frames","summary":"By default, curl automatically responds to WebSocket PING frames. Because curl\nlacks an upper bound on memory allocation for unacknowledged frames, a\nmalicious server can exhaust all available memory by flooding curl with rapid,\nsequenti…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-770"],"vendor":"haxx","product":"curl","affected":["curl >= 8.16.0, < 8.21.0"],"patched":["curl 8.21.0"],"published":"2026-07-03","updated":"2026-09-15","sourceUpdated":"2026-09-15T07:16:25.700","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-11586","references":[{"url":"https://curl.se/docs/CVE-2026-11586.html","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"https://curl.se/docs/CVE-2026-11586.json","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"https://hackerone.com/reports/3788931","label":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-07-06T15:16:22.568075Z"},"epss":0.00609,"epssPercentile":0.47806,"ingestedAt":"2026-07-04T04:55:39.424Z","slug":"CVE-2026-11586","body":"## Overview\n\nBy default, curl automatically responds to WebSocket PING frames. Because curl\nlacks an upper bound on memory allocation for unacknowledged frames, a\nmalicious server can exhaust all available memory by flooding curl with rapid,\nsequential PING messages.\n\n## Affected\n\n- `curl >= 8.16.0, < 8.21.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `curl 8.21.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":203481,"id":"CVE-2026-11586","ts":1789457645682,"field":"cvss","old":null,"new":"7.5"},{"seq":203480,"id":"CVE-2026-11586","ts":1789457645682,"field":"severity","old":"none","new":"high"}]}