CVE-2026-107928 — info leak uploading over WebSockets with GnuTLS
When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_s…
Published: 2026-10-20 · CVSS: Unscored
When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was given to send**. GnuTLS does that after a blocked send.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7