Security Advisory
CVE-2026-11586
7.5
HIGH
Vulnerability Description
By default, curl automatically responds to WebSocket PING frames. Because curl
lacks an upper bound on memory allocation for unacknowledged frames, a
malicious server can exhaust all available memory by flooding curl with rapid,
sequential PING messages.
Published Date
July 3, 2026
Official Source
NIST NVD Advisory