Loading vulnerability…
CVE-2026-107928 is an out-of-bounds read vulnerability affecting curl versions earlier than 8.23.0 when built with GnuTLS. A malicious WebSocket server can trigger a condition in which gnutls_record_send() reports more bytes sent than it was given. Subsequent send-buffer handling causes curl to read beyond the buffer and transmit adjacent memory to the server. The curl project classifies the vulnerability as low severity.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An out-of-bounds read in curl built with GnuTLS allows a malicious WebSocket server to cause disclosure of memory beyond the send buffer. After a blocked send, gnutls_record_send() can report more bytes sent than were supplied, triggering the flaw. The advisory rates it Medium with a CVSS v3.1 score of 4.8. Amazon Linux 2 Core, Amazon Linux 2023, and Amazon Linux 2027 Preview curl packages are explicitly listed as not affected.
Referenced by an Ubuntu local security check covering curl packages. The content provides no vulnerability-specific technical description. Exploit availability is reported at plugin level, without identifying which listed vulnerabilities have exploits.
A critical vulnerability affecting curl packages, rated CVSS v3 9.8. The listed vector indicates network exploitation with low complexity, no privileges or user interaction required, and high confidentiality, integrity, and availability impacts. The advisory provides no technical description of the flaw. Patches were published on October 14, 2026.
Low-severity vulnerability in curl fixed in version 8.23.0. The article provides no technical details.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.