CVE-2026-11586 Overview
CVE-2026-11586 is a memory exhaustion vulnerability in curl, the widely deployed command-line data transfer tool and library maintained by Haxx. By default, curl automatically responds to WebSocket PING frames received from a server. The implementation lacks an upper bound on memory allocation for unacknowledged frames. A malicious server can flood a connected curl client with rapid, sequential PING messages. This causes curl to queue pong responses without limit, exhausting all available memory on the client host [CWE-770: Allocation of Resources Without Limits or Throttling].
Critical Impact
A remote malicious WebSocket server can trigger unbounded memory allocation in curl, resulting in denial of service on the client host.
Affected Products
- Haxx curl (WebSocket-enabled builds)
- Applications and scripts that use libcurl for WebSocket client connections
- Automated pipelines and CI/CD workflows that pull data via curl over ws:// or wss://
Discovery Timeline
- 2026-07-03 - CVE-2026-11586 published to the National Vulnerability Database
- 2026-07-07 - Last updated in NVD database
Technical Details for CVE-2026-11586
Vulnerability Analysis
The WebSocket protocol (RFC 6455) defines control frames including PING and PONG. A server can send a PING at any time, and a compliant client is expected to respond with a PONG containing the same payload. curl implements this behavior by default when handling WebSocket connections.
The defect lies in how curl queues outbound PONG responses. When PING frames arrive faster than the client can transmit corresponding PONG frames, unacknowledged responses accumulate in memory. curl does not enforce a ceiling on the number or total size of queued frames. A server that streams PINGs at a high rate — potentially with large payloads — forces the client to allocate memory indefinitely until the process or host is starved of resources.
Root Cause
The root cause is missing resource throttling on the WebSocket control-frame response queue. The code path that generates automatic PONG responses lacks a bounded buffer, back-pressure mechanism, or rate limiter. This maps directly to [CWE-770], where a resource is allocated in response to attacker-controlled input without a hard limit.
Attack Vector
Exploitation requires the victim to initiate a WebSocket connection to a server the attacker controls or has compromised. Once the connection is established, the server transmits PING frames in a tight loop. Each PING triggers a queued PONG on the client side. Memory usage grows linearly with the volume of incoming PINGs. The attack requires no authentication, no user interaction beyond the initial connection, and works across ws:// and wss:// transports.
No public proof-of-concept is available. Technical details are documented in the cURL CVE-2026-11586 Advisory and the HackerOne Report #3788931.
Detection Methods for CVE-2026-11586
Indicators of Compromise
- Rapid, sustained memory growth in processes linking libcurl while a WebSocket session is active
- Out-of-memory (OOM) kills or allocator failures in applications performing WebSocket transfers with curl
- Outbound WebSocket connections to untrusted or newly observed hosts followed by client-side resource exhaustion
Detection Strategies
- Inventory hosts and containers that ship affected versions of curl or libcurl and identify those that enable the WebSocket feature
- Correlate process memory metrics with active WebSocket network flows to spot pathological PING/PONG ratios
- Monitor for high-frequency PING opcode (0x9) traffic from a single server toward client processes
Monitoring Recommendations
- Alert on curl or dependent processes exceeding memory baselines during outbound WebSocket sessions
- Log and review WebSocket destinations invoked from CI/CD runners, servers, and workstations
- Track EPSS movement for CVE-2026-11586; the current probability is 0.86% at the 54th percentile as of 2026-07-09
How to Mitigate CVE-2026-11586
Immediate Actions Required
- Upgrade curl and libcurl to a version that includes the fix referenced in the cURL CVE-2026-11586 Advisory
- Audit application code that uses libcurl WebSocket APIs and restrict connections to trusted server endpoints
- Constrain per-process memory using cgroups, ulimit, or container resource limits so a runaway curl cannot exhaust the host
Patch Information
Haxx has published an official advisory at curl.se/docs/CVE-2026-11586.html with machine-readable metadata available in the JSON advisory. Apply the vendor-supplied patch or upgrade to a fixed release. Rebuild any statically linked binaries or container images that bundle libcurl.
Workarounds
- Disable WebSocket support at build time using --disable-websockets if the feature is not required
- Handle PING frames manually in application code and enforce an application-level rate limit on responses
- Route WebSocket traffic through an egress proxy that inspects and throttles control-frame volume
# Verify installed curl version and WebSocket support
curl --version
curl-config --feature | grep -i websocket
# Enforce a per-process memory ceiling as a defense-in-depth control
systemd-run --scope -p MemoryMax=256M curl wss://example.invalid/socket
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
