Is the DLP agent vulnerable to CVE-2026-11586

Products

• Data Loss Prevention Core Package

Issue/Introduction

By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages

Resolution

DLP Endpoint Agent does not use WebSockets. No curl_ws_* API calls, CURLPROTO_WS, or ws:// / wss:// URLs exist in the codebase. All communications are HTTPS POST only.