Allocation of Resources Without Limits or Throttling in cURL - CVE-2026-11586
Published: June 24, 2026
Vulnerability identifier: #VU135074
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-11586
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the WebSocket auto-PONG handling when processing rapid sequential WebSocket PING frames from a server. A remote attacker can send rapid sequential PING frames to cause a denial of service.
This issue affects both libcurl and the curl command line tool.
Affected software
cURL
LANTIME Operating System Firmware (LTOS)
Ubuntu
curl (Ubuntu package)
LANTIME Operating System Firmware (LTOS)
Ubuntu
curl (Ubuntu package)
How to mitigate CVE-2026-11586
Install security update from vendor's website.
cURL - update to 8.21.0
LANTIME Operating System Firmware (LTOS) - update to 7.10.013
curl (Ubuntu package) - addressed in versions 7.35.0-1ubuntu2.20+esm21, 7.47.0-1ubuntu2.19+esm17, 7.58.0-2ubuntu3.24+esm10, 7.68.0-1ubuntu2.25+esm5, 8.5.0-2ubuntu10.11, 8.14.1-2ubuntu1.5, 8.18.0-1ubuntu2.3
LANTIME Operating System Firmware (LTOS) - update to 7.10.013
curl (Ubuntu package) - addressed in versions 7.35.0-1ubuntu2.20+esm21, 7.47.0-1ubuntu2.19+esm17, 7.58.0-2ubuntu3.24+esm10, 7.68.0-1ubuntu2.25+esm5, 8.5.0-2ubuntu10.11, 8.14.1-2ubuntu1.5, 8.18.0-1ubuntu2.3