CVE-2025-10148 Details
Description
curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.
A vulnerability exists in curl's WebSocket implementation, specifically in versions 8.11.0 through 8.15.0. The issue arises because the WebSocket code fails to update the 32-bit mask pattern for each outgoing frame, as required by the WebSocket specification (RFC 6455). Instead, a fixed mask is used throughout the entire connection. This predictable masking allows a malicious server to manipulate traffic between two parties, potentially poisoning the cache of an involved proxy (either configured or transparent) with fake HTTP content. This cached, poisoned content could then be served to users of that proxy, leading to further exploitation.
Users are advised to upgrade curl to version 8.16.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 12, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://curl.se/docs/CVE-2025-10148.html | curl | PatchVendor Advisory |
| https://curl.se/docs/CVE-2025-10148.json | curl | Vendor Advisory |
| https://hackerone.com/reports/3330839 | curl | Issue TrackingThird Party Advisory |
| http://www.openwall.com/lists/oss-security/2025/09/10/2 | CVE | Mailing ListPatchThird Party Advisory |
| http://www.openwall.com/lists/oss-security/2025/09/10/3 | CVE | Mailing ListThird Party Advisory |
| http://www.openwall.com/lists/oss-security/2025/09/10/4 | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-340 | Generation of Predictable Numbers or Identifiers | curl |
Affected Products
| Product | Versions |
|---|---|
| haxx curl | >= 8.11.0, < 8.16.0 |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CVE |
| Sep 15, 2026 | CVE Modified | curl |
| Jun 17, 2026 | CVE Modified | curl |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 20, 2026 | Initial Analysis | [email protected] |
| Nov 18, 2025 | CVE Modified | CVE |
| Nov 4, 2025 | CVE Modified | CVE |
| Sep 12, 2025 | CVE Modified | CISA-ADP |
| Sep 12, 2025 | New CVE Received | curl |