CVE-2025-5399

CWE-83510 documents8 sources
Severity
7.5HIGH
EPSS
0.5%
top 34.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Haxx CurlCurl Curl
Timeline
PublishedJun 7
Latest updateOct 15

Description

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS libcurl-using application.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶NVDhaxx/curl8.13.0 — 8.14.1
▶Alpinecurl< 8.14.1-r0+4
▶Debiancurl< 8.14.1-1+1
▶CVEListV5curl/curl8.14.0 — 8.14.0+1

🔴Vulnerability Details

4
GHSA
GHSA-8h93-38hx-vv92: Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless↗2025-06-07
▶
CVEList
WebSocket endless loop↗2025-06-07
▶
OSV
CVE-2025-5399: Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless↗2025-06-07
▶
OSV
CVE-2025-5399: Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless↗2025-06-07
▶

📋Vendor Advisories

4
Oracle
Oracle Oracle Communications Applications Risk Matrix: Core (MySQL Server) — CVE-2025-5399↗2025-10-15
▶
Oracle
Oracle Oracle MySQL Risk Matrix: Server: Packaging (curl) — CVE-2025-5399↗2025-07-15
▶
Red Hat
curl: libcurl: WebSocket endless loop↗2025-06-07
▶
Debian
CVE-2025-5399: curl - Due to a mistake in libcurl's WebSocket code, a malicious server can send a part...↗2025
▶

💬Community

1
HackerOne
CVE-2025-5399: WebSocket endless loop↗2025-06-04
▶
CVE-2025-5399 (HIGH CVSS 7.5) | Due to a mistake in libcurl's WebSo | cvebase.io