Buffer Over-read Affecting libcurl package, versions [7.86.0,8.23.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-CONAN-LIBCURL-21194412
- published18 Oct 2026
- disclosed14 Oct 2026
- creditUnknown
Introduced: 14 Oct 2026
NewCVE-2026-107928 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade libcurl to version 8.23.0 or higher.
Overview
Affected versions of this package are vulnerable to Buffer Over-read in the GnuTLS backend during WebSocket communication with a malicious server when a transmission is blocked. An attacker can cause the client to crash or access sensitive memory contents by manipulating I/O blocking conditions during the connection. This is only exploitable if the build uses the GnuTLS backend and connects to an untrusted WebSocket server under specific I/O blocking circumstances.