PT-2025-37027 · Curl+4 · Curl+4
Calvin Ruocco
+1
·
Published
2025-01-01
·
Updated
2026-06-05
·
CVE-2025-10148
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
curl (affected versions not specified)
Description:
The websocket code in curl did not update the 32-bit mask pattern for each new outgoing frame, as required by the specification. Instead, a fixed mask was used throughout the entire connection. This predictable mask pattern could allow a malicious server to induce traffic between communicating parties that a proxy server might interpret as genuine HTTP traffic, potentially poisoning its cache and serving malicious content to users.
Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Suse
Ubuntu
Curl