curl vulnerability

What happened

By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.

Affected versions

curl: 8.16.0 through before 8.16.1 (semver); 8.17.0 through before 8.20.1 (semver); 0b091328773c64e23f5c4739da74527093c6a5ab through before 849317ff5c5a5e13f50ec3d001e46ddffa77d8a4 (git); 8.20.0; 8.19.0; 8.18.0; 8.17.0; 8.16.0 Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.