When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. (CVE-2026-107928)

The vulnerability in curl arises when it is compiled with GnuTLS as the TLS backend. Specifically, if a malicious WebSocket server manipulates the TLS record sending process, it can cause gnutls_record_send() to report that more bytes were sent than actually provided. This leads curl to send memory past its allocated send buffer, resulting in an out-of-bounds read. This flaw is related to the handling of blocked sends within GnuTLS and affects the memory safety of curl's data transmission.

An attacker controlling a malicious WebSocket server can exploit this vulnerability to cause curl to read and send memory beyond its intended buffer. This could potentially lead to information disclosure of memory contents from the client running curl. There is no indication of remote code execution or other impacts from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider avoiding using curl builds with GnuTLS for WebSocket connections or use alternative TLS backends if possible.