CVE-2026-11586: curl WebSocket Memory Exhaustion Denial-of-Service

Technical summary

CVE-2026-11586 is a resource exhaustion vulnerability (CWE-770) in curl's WebSocket protocol handler. The vulnerability stems from curl's default behavior of automatically acknowledging WebSocket PING frames without implementing backpressure or memory allocation limits. When a remote server floods curl with sequential PING frames, the client allocates memory for each frame without an upper bound. Since the frames accumulate faster than they can be processed, memory consumption grows unbounded, leading to a denial of service through memory exhaustion. The attack requires only network access to a WebSocket endpoint—no authentication, user interaction, or special configuration is required.

Business impact

Any organization or service that uses curl as a WebSocket client faces availability risk. This includes automated monitoring tools, API clients, CI/CD pipelines, and applications that consume WebSocket feeds. An attacker with control over a WebSocket endpoint can crash curl-based clients connecting to it, disrupting operations and potentially cascading through dependent systems. The impact is heightened for always-on services or unattended automation that cannot quickly detect and restart after a crash.

Affected systems

curl versions using WebSocket functionality are affected. Verify the specific fixed version in the official curl advisory, as the ground-truth data does not specify a patched version. Any system with curl installed that communicates with untrusted or compromised WebSocket servers is potentially vulnerable, particularly in automated environments where curl runs with elevated privileges or as part of critical infrastructure.

Exploitability

Exploitability is high. The attack vector is network-based with no authentication or user interaction required. An attacker needs only to host or compromise a WebSocket server and wait for or socially engineer a curl client to connect. The attack is trivial to execute—a simple loop sending PING frames will trigger memory exhaustion. However, the attacker must have control over the WebSocket endpoint being contacted, which limits opportunistic exploitation to scenarios where curl connects to attacker-controlled or compromised servers.

Remediation

Upgrade curl to a patched version that implements memory limits on unacknowledged WebSocket frames. Check the official curl security advisory for the minimum version that resolves this issue. Organizations should prioritize patching systems where curl is actively used for WebSocket communication, especially in production environments. Until patching is complete, network segmentation and allowlisting of trusted WebSocket endpoints can reduce exposure.

Patch guidance

Apply the official curl security update as released by the curl project. Verify the patched version against the vendor advisory to confirm it includes the fix for CVE-2026-11586. Test patched versions in a staging environment before production deployment to ensure compatibility with existing scripts or applications. For systems that cannot be patched immediately, consider disabling WebSocket functionality or restricting curl connections to known, trusted servers.

Detection guidance

Monitor for curl processes consuming abnormally high memory, particularly in short time windows. Log WebSocket connection attempts and check for connections to unexpected or untrusted servers. On systems with verbose logging, look for repeated PING frame processing without corresponding PONG responses. Memory pressure alerts on systems running automated curl-based tools may indicate active exploitation. Network-based detection is difficult without decrypting TLS; focus on endpoint-level process monitoring and resource utilization baselines.

Why prioritize this

With a CVSS 3.1 score of 7.5 (HIGH severity), this vulnerability merits prompt attention. The attack requires no authentication or user interaction and is easily exploitable by any attacker controlling a WebSocket endpoint. The impact—complete denial of service—is significant for any system relying on curl's availability. However, the attacker's need to control the WebSocket endpoint limits the blast radius compared to a remote code execution vulnerability. Organizations should prioritize patching systems where curl actively connects to third-party or less-trusted WebSocket services.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a HIGH-severity network-based denial-of-service attack with complete impact on availability. The score appropriately captures the lack of authentication requirements, ease of exploitation, and the severity of memory exhaustion leading to service unavailability. It does not assign risk for confidentiality or integrity since the vulnerability does not leak data or allow code execution. The score is not elevated to CRITICAL because exploitation requires the victim to connect to an attacker-controlled server, rather than being remotely exploitable against arbitrary targets.

Frequently asked questions