CVE-2026-11586

Advisory lineage Upstream: 0 Downstream: 7

Downstream

ALPINE-CVE-2026-11586 DEBIAN-CVE-2026-11586 OPENSUSE-SU-2026:11230-1 RHSA-2026:29017 RHSA-2026:34975 UBUNTU-CVE-2026-11586

PUBLISHED

Published: 03 Jul 2026, 06:13

Last modified:06 Jul 2026, 15:16

Vulnerability Summary

Overall Risk (default)

medium

30/100

CVSS Score

7.5 HIGH

v3.1 (cve.org)

EPSS Score

0.21% LOW

0% probability 0.00%

KEV

Not listed

Ransomware

No reports

Public exploits

None found

Dark Web

Not detected

Timeline

03 Jul 2026, 06:13

Published

Vulnerability first disclosed

06 Jul 2026, 15:16

Last Modified

Vulnerability information updated

Description

By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.

CVSS Metrics

v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.21%• Percentile: 11%

Affected Systems

curl•curl
8.20.0 | 8.19.0 | 8.18.0 | 8.17.0 | 8.16.0