Change #278702
| Category | None |
| Changed by | Stefan Eissing <stefan@eissing.org> |
| Changed at | Wed 19 Aug 2026 14:23:54 |
| Repository | https://api.github.com/repos/curl/curl |
| Project | curl/curl |
| Branch | curl-8.20.X |
| Revision | a7912e6f4da29da844b59fc32d686e2beeb72962 |
Comments
CVE-2026-11586: WS Auto-PONG memory exhaustion Cherry-picked from 849317ff5c5a5e13f50ec3d0 ws: make pong sending lazy Do not send PONG frames unless there is sufficient space left in the websocket send buffer. A server might be lazy in reading our data and intermediary PONG frames can be skipped by a client (RFC 6455, ch. 5.5.3). Add test case measuring no real RSS increase on a server blasting with PING frames. Closes #21911
Changed files
- tests/http/test_20_websockets.py