CVE-2025-5399
published 2025-06-07CVE-2025-5399: Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.57%
69.0th percentile
Due to a mistake in libcurl's WebSocket code, a malicious server can send a
particularly crafted packet which makes libcurl get trapped in an endless
busy-loop.
There is no other way for the application to escape or exit this loop other
than killing the thread/process.
This might be used to DoS libcurl-using application.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| curl | curl | 8.13.0 – 8.13.0 | — |
| curl | curl | 8.14.0 – 8.14.0 | — |
| debian | curl | < curl 8.14.1-1 (forky) | curl 8.14.1-1 (forky) |
| haxx | curl | >= 0 < 8.14.1-r0 | 8.14.1-r0 |
| haxx | curl | >= 0 < 8.14.1-r0 | 8.14.1-r0 |
| haxx | curl | >= 0 < 8.14.1-r0 | 8.14.1-r0 |
| haxx | curl | >= 0 < 8.14.1-r0 | 8.14.1-r0 |
| haxx | curl | >= 0 < 8.14.1-r0 | 8.14.1-r0 |
| haxx | curl | >= 0 < 8.14.1-1 | 8.14.1-1 |
| haxx | curl | >= 0 < 8.14.1-1 | 8.14.1-1 |
| haxx | curl | >= 8.13.0 < 8.14.1 | 8.14.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5LOW
vendor_redhat7.5HIGH
vendor_oracle4.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8h93-38hx-vv92: Due to a mistake in libcurl's WebSocket code, a malicious server can send a
particularly crafted packet which makes libcurl get trapped in an endless
ghsa_unreviewed·2025-06-07
CVE-2025-5399 [HIGH] CWE-835 GHSA-8h93-38hx-vv92: Due to a mistake in libcurl's WebSocket code, a malicious server can send a
particularly crafted packet which makes libcurl get trapped in an endless
Due to a mistake in libcurl's WebSocket code, a malicious server can send a
particularly crafted packet which makes libcurl get trapped in an endless
busy-loop.
There is no other way for the application to escape or exit this loop other
than killing the thread/process.
This might be used to DoS libcurl-using application.
OSV
CVE-2025-5399: Due to a mistake in libcurl's WebSocket code, a malicious server can send a
particularly crafted packet which makes libcurl get trapped in an endless
osv·2025-06-07·CVSS 7.5
CVE-2025-5399 [HIGH] CVE-2025-5399: Due to a mistake in libcurl's WebSocket code, a malicious server can send a
particularly crafted packet which makes libcurl get trapped in an endless
Due to a mistake in libcurl's WebSocket code, a malicious server can send a
particularly crafted packet which makes libcurl get trapped in an endless
busy-loop.
There is no other way for the application to escape or exit this loop other
than killing the thread/process.
This might be used to DoS libcurl-using application.
OSV
CVE-2025-5399: Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless
osv·2025-06-07·CVSS 7.5
CVE-2025-5399 [HIGH] CVE-2025-5399: Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless
Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS libcurl-using application.
Oracle
Oracle Oracle Communications Applications Risk Matrix: Core (MySQL Server) — CVE-2025-5399
vendor_oracle·2025-10-15·CVSS 4.5
CVE-2025-5399 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Core (MySQL Server) — CVE-2025-5399
Oracle Oracle Communications Applications Risk Matrix: Core (MySQL Server) vulnerability
CVE: CVE-2025-5399
CVSS: 4.5
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuoct2025 (OCT 2025)
Oracle
Oracle Oracle MySQL Risk Matrix: Server: Packaging (curl) — CVE-2025-5399
vendor_oracle·2025-07-15·CVSS 4.3
CVE-2025-5399 [HIGH] Oracle Oracle MySQL Risk Matrix: Server: Packaging (curl) — CVE-2025-5399
Oracle Oracle MySQL Risk Matrix: Server: Packaging (curl) vulnerability
CVE: CVE-2025-5399
CVSS: 4.3
Protocol: MySQL Protocol
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2025 (JUL 2025)
Red Hat
curl: libcurl: WebSocket endless loop
vendor_redhat·2025-06-07·CVSS 7.5
CVE-2025-5399 [HIGH] CWE-835 curl: libcurl: WebSocket endless loop
curl: libcurl: WebSocket endless loop
Due to a mistake in libcurl's WebSocket code, a malicious server can send a
particularly crafted packet which makes libcurl get trapped in an endless
busy-loop.
There is no other way for the application to escape or exit this loop other
than killing the thread/process.
This might be used to DoS libcurl-using application.
A flaw was found in libcurl's WebSocket handling. This vulnerability allows a malicious server to cause an applicaiton level denial of service (DoS) by triggering an infinite busy-loop, effectively trapping the application thread, via a specially crafted WebSocket packet when "auto-pong" is enabled.
Statement: The severity of this vulnerability is rated Moderate, as it does not impact system availability. The effects are confined to
Debian
CVE-2025-5399: curl - Due to a mistake in libcurl's WebSocket code, a malicious server can send a part...
vendor_debian·2025·CVSS 7.5
CVE-2025-5399 [HIGH] CVE-2025-5399: curl - Due to a mistake in libcurl's WebSocket code, a malicious server can send a part...
Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS libcurl-using application.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 8.14.1-1)
sid: resolved (fixed in 8.14.1-1)
trixie: resolved (fixed in 8.14.1-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-5399 curl: libcurl: WebSocket endless loop
bugzilla·2025-06-07·CVSS 7.5
CVE-2025-5399 [HIGH] CVE-2025-5399 curl: libcurl: WebSocket endless loop
CVE-2025-5399 curl: libcurl: WebSocket endless loop
Due to a mistake in libcurl's WebSocket code, a malicious server can send a
particularly crafted packet which makes libcurl get trapped in an endless
busy-loop.
There is no other way for the application to escape or exit this loop other
than killing the thread/process.
This might be used to DoS libcurl-using application.
Discussion:
When the flow of the web always tries to invade the device in a path that can be clicked wrong. How to exploit the above measure? https://unoonlinefree.io/
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2025:15699 https://access.redhat.com/errata/RHSA-2025:15699
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
HackerOne
CVE-2025-5399: WebSocket endless loop
hackerone·2025-06-04·CVSS 7.5
CVE-2025-5399 [HIGH] CVE-2025-5399: WebSocket endless loop
CVE-2025-5399: WebSocket endless loop
The function `curl_ws_send()` in libcurl on commit [12d13b84fa40aa657b83d5458944dbd9b978fb7e](https://github.com/curl/curl/blob/12d13b84fa40aa657b83d5458944dbd9b978fb7e/lib/ws.c) contains an infinite loop that can be triggered by a malicious server under specific circumstances.
If an application uses `curl_ws_recv()` and `curl_ws_send()` to communicate with a websocket server, a malicious server can send a carefully timed PING message while the client is constructing a frame via `CURLWS_OFFSET` that leads to the next `curl_ws_send()` invocation not terminating a loop that flushes data.
The affected code is in file `lib/ws.c` in function `curl_ws_send()` on [lines 1376 - 1419](https://github.com/curl/curl/blob/12d13b84fa40aa657b83d5458944dbd9b978fb7e/
2025-06-07
Published