When curl is built with GnuTLS, a malicious WebSocket server can cause curl to send memory past its send buffer. The flaw arises when gnutls_record_send() reports more bytes sent than were actually provided, following a blocked send. This out‑of‑bounds read can expose data from adjacent memory or lead to a client crash, resulting in either information leakage or denial of service for the utility.

All installations of curl that are compiled with the GnuTLS library are potentially affected. The vendor product is libcurl, and any version that uses GnuTLS for TLS handling and supports WebSocket communication could be vulnerable. No specific patch version is listed, so users should verify their curl and GnuTLS versions against the vendor release notes.

The CVSS score of 8.1 reflects high severity. EPSS score is less than 1%, indicating a very low exploitation probability. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker who can act as or impersonate a WebSocket server can trigger the problematic transmission path. The likely attack vector is a remote, network‑based exploit where the attacker initiates a WebSocket session over TLS, inducing curl to send data described by the incorrect gnutls_record_send() return value. The risk is limited to leaking data that happens to reside beside the send buffer or crashing the curl process, which could affect client availability but does not provide code execution or privilege escalation.