Curl automatically responds to WebSocket PING frames, yet it does not place an upper bound on memory allocation for unacknowledged frames. A malicious server can overwhelm a curl client by sending rapid, successive PING messages, causing the client to allocate more and more memory until it exhausts the system’s available memory, crashes, or becomes unusably slow. This flaw is a classic example of uncontrolled memory allocation (CWE-770).

The affected component is the curl command-line HTTP client and its underlying libcurl library. All current installations of curl are susceptible unless patched; no specific version ranges are provided. Any user or service that employs curl to connect to a WebSocket endpoint can be affected. The vendor is curl:curl.

The CVSS score of 7.5 denotes high severity. An EPSS score below 1% indicates a low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit this remotely by hosting a malicious WebSocket server that floods a curl client with PING messages, leading to memory exhaustion that terminates or degrades the client process and effectively denies service to the user.