Curl automatically replies to WebSocket Ping frames, yet the client does not enforce a maximum on the memory allocated for unacknowledged frames, creating a memory exhaustion flaw (CWE‑770). A malicious server can send a rapid stream of Ping messages that cause curl to keep allocating new memory for each response until the process exhausts all available system memory, leading to a crash or severe performance degradation.

The vulnerable component is the libcurl library bundled with the curl command‑line HTTP client. No specific affected version ranges are given in the CVE data; thus it is unclear which releases are susceptible. Any environment that uses curl to connect to a WebSocket endpoint may be targeted. The vendor is curl:curl.

The likely attack vector is remote from a malicious WebSocket server; this inference is not explicitly stated in the description. The CVSS score of 7.5 indicates high severity. The EPSS score below 1% indicates low but nonzero exploitation probability, and the flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to host a malicious WebSocket server that floods a curl instance with rapid Ping frames. When the target client lacks resource limits, the memory exhaustion will cause the process to terminate or become unresponsive, effectively denying service to the user. The attack vector is remote and originates from the hostile WebSocket server.