CVE-2025-5399
MediumSummary
Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS.
Risk Assessment
A DoS attack can cause unavailability of applications using libcurl with WebSocket, impacting service continuity.
Recommendation
Update libcurl to a patched version and consider limiting trust to WebSocket servers.
Original NVD description (English source)
Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS li