Vulnerability-Lookup

CVE-2025-10148 (GCVE-0-2025-10148)

Vulnerability from cvelistv5 – Published: 2025-09-12 05:10 – Updated: 2026-09-15 06:02

Title

predictable WebSocket mask

Summary

curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-12 17:16 UTC

CWE

CWE-340 - Generation of Predictable Numbers or Identifiers

Assigner

curl redhat root

References

6 references

URL	Tags
https://curl.se/docs/CVE-2025-10148.json
https://curl.se/docs/CVE-2025-10148.html
https://hackerone.com/reports/3330839
http://www.openwall.com/lists/oss-security/2025/09/10/2
http://www.openwall.com/lists/oss-security/2025/09/10/3
http://www.openwall.com/lists/oss-security/2025/09/10/4

Impacted products

3 products

Vendor	Product	Version	CPE status
curl	curl	Affected: 8.11.0 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.0 (semver)	guessed
curl	curl	Affected: d78e129d50b2d190f1c1bde2ad1f62f02f152db0 , < 84db7a9eae8468c0445b15aa806fa7fa806fa0f2 (git)	guessed
curl	curl	Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0	guessed

Credits

Calvin Ruocco (Vector Informatik GmbH) Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-10148",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-12T17:16:46.486840Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-12T17:17:12.815Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-18T20:05:32.822Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/09/10/2"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/09/10/3"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/09/10/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "8.11.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.0",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "84db7a9eae8468c0445b15aa806fa7fa806fa0f2",
              "status": "affected",
              "version": "d78e129d50b2d190f1c1bde2ad1f62f02f152db0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Calvin Ruocco (Vector Informatik GmbH)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "curl\u0027s WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-340",
              "description": "Generation of Predictable Numbers or Identifiers",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:02:23.283Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2025-10148.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2025-10148.html"
        },
        {
          "url": "https://hackerone.com/reports/3330839"
        }
      ],
      "title": "predictable WebSocket mask",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "8.11.0"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "d78e129d50b2d190f1c1bde2ad1f62f02f152db0"
                  },
                  {
                    "fixed": "84db7a9eae8468c0445b15aa806fa7fa806fa0f2"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1",
              "8.11.0"
            ]
          }
        ],
        "aliases": [
          "CVE-2025-10148"
        ],
        "credits": [
          {
            "name": "Calvin Ruocco (Vector Informatik GmbH)",
            "type": "finder"
          },
          {
            "name": "Daniel Stenberg",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Generation of Predictable Numbers or Identifiers",
            "id": "CWE-340"
          },
          "URL": "https://curl.se/docs/CVE-2025-10148.json",
          "affects": "both",
          "award": {
            "amount": "505",
            "currency": "USD"
          },
          "issue": "https://hackerone.com/reports/3330839",
          "last_affected": "8.15.0",
          "package": "curl",
          "severity": "Low",
          "www": "https://curl.se/docs/CVE-2025-10148.html"
        },
        "details": "curl\u0027s WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy.",
        "id": "CURL-CVE-2025-10148",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2025-09-10T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "predictable WebSocket mask"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2025-10148",
    "datePublished": "2025-09-12T05:10:37.469Z",
    "dateReserved": "2025-09-09T03:45:41.908Z",
    "dateUpdated": "2026-09-15T06:02:23.283Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-10148",
      "date": "2026-09-15",
      "epss": "0.00499",
      "percentile": "0.41371"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-10148\",\"sourceIdentifier\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"published\":\"2025-09-12T06:15:40.020\",\"lastModified\":\"2026-09-15T07:16:21.967\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"curl\u0027s WebSocket code did not update the 32-bit mask pattern for each new\\noutgoing frame as the specification says. Instead it used a fixed mask that\\npersisted and was used throughout the entire connection.\\n\\nA predictable mask pattern allows for a malicious server to induce traffic\\nbetween the two communicating parties that could be interpreted by an involved\\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\\nand thereby poison its cache. That cached poisoned content could then be\\nserved to all users of that proxy.\"}],\"affected\":[{\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"affectedData\":[{\"vendor\":\"curl\",\"product\":\"curl\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"8.11.0\",\"lessThan\":\"8.14.2\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.15.0\",\"lessThan\":\"8.16.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"curl\",\"product\":\"curl\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://github.com/curl/curl.git\",\"versions\":[{\"version\":\"d78e129d50b2d190f1c1bde2ad1f62f02f152db0\",\"lessThan\":\"84db7a9eae8468c0445b15aa806fa7fa806fa0f2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"curl\",\"product\":\"curl\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"8.15.0\",\"status\":\"affected\"},{\"version\":\"8.14.1\",\"status\":\"affected\"},{\"version\":\"8.14.0\",\"status\":\"affected\"},{\"version\":\"8.13.0\",\"status\":\"affected\"},{\"version\":\"8.12.1\",\"status\":\"affected\"},{\"version\":\"8.12.0\",\"status\":\"affected\"},{\"version\":\"8.11.1\",\"status\":\"affected\"},{\"version\":\"8.11.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-09-12T17:16:46.486840Z\",\"id\":\"CVE-2025-10148\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-340\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.11.0\",\"versionEndExcluding\":\"8.16.0\",\"matchCriteriaId\":\"A2D88104-00EB-4B8B-88D4-9FCCEF41FA6B\"}]}]}],\"references\":[{\"url\":\"https://curl.se/docs/CVE-2025-10148.html\",\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://curl.se/docs/CVE-2025-10148.json\",\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://hackerone.com/reports/3330839\",\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2025/09/10/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2025/09/10/3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2025/09/10/4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-31T11:48:01+00:00",
      "cve": "CVE-2025-10148",
      "id": "CVE-2025-10148",
      "initial_release_date": "2025-09-12T05:10:37.469000+00:00",
      "product_status:fixed": "3",
      "product_status:known_affected": "6",
      "product_status:known_not_affected": "23",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "curl: predictable WebSocket mask",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-10148.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2025/09/10/2\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2025/09/10/3\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2025/09/10/4\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-18T20:05:32.822Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-10148\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-09-12T17:16:46.486840Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-09-12T17:17:07.462Z\"}}], \"cna\": {\"title\": \"predictable WebSocket mask\", \"x_osv\": {\"id\": \"CURL-CVE-2025-10148\", \"aliases\": [\"CVE-2025-10148\"], \"credits\": [{\"name\": \"Calvin Ruocco (Vector Informatik GmbH)\", \"type\": \"finder\"}, {\"name\": \"Daniel Stenberg\", \"type\": \"remediation developer\"}], \"details\": \"curl\u0027s WebSocket code did not update the 32-bit mask pattern for each new\\noutgoing frame as the specification says. Instead it used a fixed mask that\\npersisted and was used throughout the entire connection.\\n\\nA predictable mask pattern allows for a malicious server to induce traffic\\nbetween the two communicating parties that could be interpreted by an involved\\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\\nand thereby poison its cache. That cached poisoned content could then be\\nserved to all users of that proxy.\", \"summary\": \"predictable WebSocket mask\", \"affected\": [{\"ranges\": [{\"type\": \"SEMVER\", \"events\": [{\"introduced\": \"8.11.0\"}, {\"fixed\": \"8.14.2\"}, {\"introduced\": \"8.15.0\"}, {\"fixed\": \"8.16.0\"}]}, {\"repo\": \"https://github.com/curl/curl.git\", \"type\": \"GIT\", \"events\": [{\"introduced\": \"d78e129d50b2d190f1c1bde2ad1f62f02f152db0\"}, {\"fixed\": \"84db7a9eae8468c0445b15aa806fa7fa806fa0f2\"}]}], \"versions\": [\"8.15.0\", \"8.14.1\", \"8.14.0\", \"8.13.0\", \"8.12.1\", \"8.12.0\", \"8.11.1\", \"8.11.0\"]}], \"modified\": \"2026-09-07T10:34:51.00Z\", \"published\": \"2025-09-10T08:00:00.00Z\", \"schema_version\": \"1.5.0\", \"database_specific\": {\"CWE\": {\"id\": \"CWE-340\", \"desc\": \"Generation of Predictable Numbers or Identifiers\"}, \"URL\": \"https://curl.se/docs/CVE-2025-10148.json\", \"www\": \"https://curl.se/docs/CVE-2025-10148.html\", \"award\": {\"amount\": \"505\", \"currency\": \"USD\"}, \"issue\": \"https://hackerone.com/reports/3330839\", \"affects\": \"both\", \"package\": \"curl\", \"severity\": \"Low\", \"last_affected\": \"8.15.0\"}}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Calvin Ruocco (Vector Informatik GmbH)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Daniel Stenberg\"}], \"affected\": [{\"vendor\": \"curl\", \"product\": \"curl\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.11.0\", \"lessThan\": \"8.14.2\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.15.0\", \"lessThan\": \"8.16.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://github.com/curl/curl.git\", \"vendor\": \"curl\", \"product\": \"curl\", \"versions\": [{\"status\": \"affected\", \"version\": \"d78e129d50b2d190f1c1bde2ad1f62f02f152db0\", \"lessThan\": \"84db7a9eae8468c0445b15aa806fa7fa806fa0f2\", \"versionType\": \"git\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"curl\", \"product\": \"curl\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.15.0\"}, {\"status\": \"affected\", \"version\": \"8.14.1\"}, {\"status\": \"affected\", \"version\": \"8.14.0\"}, {\"status\": \"affected\", \"version\": \"8.13.0\"}, {\"status\": \"affected\", \"version\": \"8.12.1\"}, {\"status\": \"affected\", \"version\": \"8.12.0\"}, {\"status\": \"affected\", \"version\": \"8.11.1\"}, {\"status\": \"affected\", \"version\": \"8.11.0\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://curl.se/docs/CVE-2025-10148.json\"}, {\"url\": \"https://curl.se/docs/CVE-2025-10148.html\"}, {\"url\": \"https://hackerone.com/reports/3330839\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"curl\u0027s WebSocket code did not update the 32-bit mask pattern for each new\\noutgoing frame as the specification says. Instead it used a fixed mask that\\npersisted and was used throughout the entire connection.\\n\\nA predictable mask pattern allows for a malicious server to induce traffic\\nbetween the two communicating parties that could be interpreted by an involved\\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\\nand thereby poison its cache. That cached poisoned content could then be\\nserved to all users of that proxy.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-340\", \"description\": \"Generation of Predictable Numbers or Identifiers\"}]}], \"providerMetadata\": {\"orgId\": \"2499f714-1537-4658-8207-48ae4bb9eae9\", \"shortName\": \"curl\", \"dateUpdated\": \"2026-09-15T06:02:23.283Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-10148\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-15T06:02:23.283Z\", \"dateReserved\": \"2025-09-09T03:45:41.908Z\", \"assignerOrgId\": \"2499f714-1537-4658-8207-48ae4bb9eae9\", \"datePublished\": \"2025-09-12T05:10:37.469Z\", \"assignerShortName\": \"curl\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

SUSE-SU-2025:03267-1

Vulnerability from csaf_suse - Published: 2025-09-18 11:06 - Updated: 2025-09-18 11:06

Summary

Security update for curl

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2025-10148.

CVE-2025-10148

Recommended: 103 products

Open the full advisory

SUSE-SU-2025:03268-1

Vulnerability from csaf_suse - Published: 2025-09-18 11:08 - Updated: 2025-09-18 11:08

Summary

Security update for curl

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2025-10148.

CVE-2025-10148

Recommended: 301 products

Open the full advisory

SUSE-SU-2025:20802-1

Vulnerability from csaf_suse - Published: 2025-09-26 09:20 - Updated: 2026-09-15 08:54

Summary

Security update for curl

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2025-10148.

CVE-2025-10148

Recommended: 8 products

Open the full advisory

SUSE-SU-2025:20824-1

Vulnerability from csaf_suse - Published: 2025-09-25 10:52 - Updated: 2026-09-15 08:54

Summary

Security update for curl

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2025-10148.

CVE-2025-10148

Recommended: 6 products

Open the full advisory

SUSE-SU-2025:21077-1

Vulnerability from csaf_suse - Published: 2025-11-26 14:28 - Updated: 2026-09-15 08:54

Summary

Security update for curl

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2025-10148.

CVE-2025-10148

Recommended: 8 products

Open the full advisory

SUSE-SU-2025:21145-1

Vulnerability from csaf_suse - Published: 2025-11-26 14:28 - Updated: 2026-09-15 08:54

Summary

Security update for curl

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2025-10148.

CVE-2025-10148

Recommended: 36 products

Open the full advisory

ubuntu-cve-2025-10148

Vulnerability from osv_ubuntu

Published

2025-09-12 06:15

Modified

2026-04-22 07:53

Summary

Details

curl's websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.

Severity

5.3 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2025-10148	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-10148	REPORT
	https://curl.se/docs/CVE-2025-10148.html	REPORT
	https://ubuntu.com/security/notices/USN-8062-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "8.5.0-2ubuntu10.7"
          },
          {
            "binary_name": "libcurl3t64-gnutls",
            "binary_version": "8.5.0-2ubuntu10.7"
          },
          {
            "binary_name": "libcurl4t64",
            "binary_version": "8.5.0-2ubuntu10.7"
          }
        ],
        "priority_reason": "Curl developers have rated this as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@8.5.0-2ubuntu10.7?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.5.0-2ubuntu10.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.2.1-1ubuntu3",
        "8.2.1-1ubuntu3.1",
        "8.4.0-2ubuntu1",
        "8.5.0-2ubuntu1",
        "8.5.0-2ubuntu2",
        "8.5.0-2ubuntu8",
        "8.5.0-2ubuntu9",
        "8.5.0-2ubuntu10",
        "8.5.0-2ubuntu10.1",
        "8.5.0-2ubuntu10.2",
        "8.5.0-2ubuntu10.3",
        "8.5.0-2ubuntu10.4",
        "8.5.0-2ubuntu10.5",
        "8.5.0-2ubuntu10.6"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "8.14.1-2ubuntu1.1"
          },
          {
            "binary_name": "libcurl3t64-gnutls",
            "binary_version": "8.14.1-2ubuntu1.1"
          },
          {
            "binary_name": "libcurl4t64",
            "binary_version": "8.14.1-2ubuntu1.1"
          }
        ],
        "priority_reason": "Curl developers have rated this as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@8.14.1-2ubuntu1.1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.14.1-2ubuntu1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.12.1-3ubuntu1",
        "8.13.0-5ubuntu1",
        "8.14.1-1ubuntu2",
        "8.14.1-1ubuntu3",
        "8.14.1-2ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "curl\u0027s websocket code did not update the 32 bit mask pattern for each new  outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.",
  "id": "UBUNTU-CVE-2025-10148",
  "modified": "2026-04-22T07:53:19Z",
  "published": "2025-09-12T06:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-10148"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-10148"
    },
    {
      "type": "REPORT",
      "url": "https://curl.se/docs/CVE-2025-10148.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8062-1"
    }
  ],
  "related": [
    "USN-8062-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2025-10148"
  ]
}

WID-SEC-W-2025-2023

Vulnerability from csaf_certbund - Published: 2025-09-09 22:00 - Updated: 2026-05-11 22:00

Summary

cURL: Mehrere Schwachstellen ermöglichen Manipulation von Dateien

Severity

Mittel

Scope

2 vulnerabilities in this advisory, including CVE-2025-10148.

CVE-2025-10148

Known affected: 24 products

Open the full advisory

WID-SEC-W-2026-1730

Vulnerability from csaf_certbund - Published: 2026-05-28 22:00 - Updated: 2026-05-28 22:00

Summary

Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Severity

Mittel

Scope

403 vulnerabilities in this advisory, including CVE-2025-10148.

CVE-2025-10148

Known affected: 2 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2025-10148 (GCVE-0-2025-10148)

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature