CVE-2025-10148
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification requires. Instead it used a fixed mask that persisted throughout the entire connection. A predictable mask pattern allows a malicious server to induce traffic that an involved proxy may interpret as genuine HTTP traffic and poison its cache.
Risk Assessment
Cache poisoning of the proxy can result in malicious content being served to all users of that proxy. Organizations using curl with an HTTP proxy are exposed to injection of fake responses.
Recommendation
Update curl/libcurl to a version containing the fix that updates the WebSocket mask for each frame. Consider verifying proxy cache integrity in environments using WebSocket through a proxy.
Other vulnerabilities in curl
See all- CVE-2022-27775High
An information disclosure vulnerability exists in curl versions 7.65.0 to 7.82.0 that allows reusing a connection using an IPv6 address with a different zone id.
- CVE-2022-22576High
An improper authentication vulnerability exists in curl versions 7.33.0 to 7.82.0 which might allow reuse of OAUTH2-authenticated connections without properly ensuring that the connection was authenticated with the same credentials. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S), and LDAP(S) (openldap only).
- CVE-2024-11053Low
When curl is asked to use a `.netrc` file for credentials and to follow HTTP redirects, it could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests if the netrc file has an entry matching the redirect target hostname.
- CVE-2024-9681Medium
When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects applications using HSTS and URLs with the insecure HTTP:// scheme.
- CVE-2024-8096Medium
When curl is told to use the Certificate Status Request TLS extension (OCSP stapling) to verify the server certificate, it might fail to detect some OCSP problems and wrongly consider the response as fine if the returned status reports another error than expected.
- CVE-2026-8926Critical
When curl uses a .netrc file for credentials and a URL with a username (without password) is specified, curl may wrongly retrieve and use the password of another user from .netrc for that host if no match exists for the specified user.
- CVE-2026-8925Critical
A double-free vulnerability has been found in the curl library's SASL authentication handling. The GSASL context is cleaned up twice without clearing the pointer, causing free() to be called on the same memory region twice.
- CVE-2026-8924Critical
A flaw in curl's cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check, enabling injection of cookies that curl scopes and sends to unrelated third-party domains.
- CVE-2023-38545Critical
CVE-2023-38545 is a vulnerability related to heap buffer overflow during the SOCKS5 proxy handshake in curl. The issue arises when curl passes a hostname that is too long to the proxy, leading to incorrect data copying.
- CVE-2021-22901High
curl versions 7.75.0 through 7.76.1 suffer from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client.
Original NVD description (English source)
curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS