{"id":"CVE-2026-107928","revision":null,"records":[{"revision":"2f762656a5b94c1493f152110d37c394","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107928","aliases":[],"title":"info leak uploading over WebSockets with GnuTLS","description":"When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send.","state":0,"publishedAt":"2026-10-20T20:28:17.712+00:00","modifiedAt":"2026-10-20T20:28:17.712+00:00","affected":[{"ecosystem":"Vendor product","name":"curl","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"curl\",\n \"product\": \"curl\",\n \"versions\": [\n {\n \"version\": \"8.22.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.22.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.21.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.21.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.20.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.20.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.19.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.19.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.18.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.18.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.17.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.17.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.16.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.16.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.15.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.15.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.14.1\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.14.1\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.14.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.14.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.13.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.13.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.12.1\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.12.1\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.12.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.12.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.11.1\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.11.1\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.11.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.11.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.10.1\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.10.1\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.10.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.10.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.9.1\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.9.1\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.9.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.9.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.8.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.8.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.7.1\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.7.1\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.7.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.7.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.6.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.6.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.5.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.5.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.4.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.4.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.3.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.3.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.2.1\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.2.1\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.2.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.2.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.1.2\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.1.2\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.1.1\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.1.1\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.1.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.1.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.0.1\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.0.1\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"8.0.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"8.0.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.88.1\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"7.88.1\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.88.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"7.88.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.87.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"7.87.0\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.86.0\",\n \"status\": \"affected\",\n \"lessThanOrEqual\": \"7.86.0\",\n \"versionType\": \"semver\"\n }\n ],\n \"defaultStatus\": \"unaffected\"\n }"}],"metrics":[],"references":["https://curl.se/docs/CVE-2026-107928.json","https://curl.se/docs/CVE-2026-107928.html","https://hackerone.com/reports/4099194"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107928","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107928","identifiers":["CVE-2026-107928"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-24T10:27:30.8908525+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-24T10:27:30.8908525+00:00","lastSuccessAt":"2026-10-24T10:27:31.1285633+00:00","error":null,"lastVerifiedAt":"2026-10-24T10:27:31.1285641+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-9b3cad78792c7367da03684feab05819ddebc4d137048bdbbdabdbb4d2879391-c6a8234687801ee57ab2aeb77d20947f334a6cc2941ea8b25213d5a7dcebf0ce","complete":true,"records":413884,"lastAttemptAt":"2026-10-24T10:27:30.7016219+00:00","lastSuccessAt":"2026-10-24T10:27:30.6836858+00:00","error":null,"lastVerifiedAt":"2026-10-24T10:27:30.7016219+00:00","snapshotPublishedAt":"2026-10-24T10:24:24+00:00","importing":false,"stagedRecords":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-24T10:27:30.8908525+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-24T10:27:30.8908525+00:00","lastSuccessAt":"2026-10-24T10:27:31.3689689+00:00","error":null,"lastVerifiedAt":"2026-10-24T10:27:31.3689698+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-24T10:27:30.7587662+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-24T10:27:30.7587662+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0}]}