CURL-CVE-2025-10148

See a problem?
Please try reporting it to the source first.
Source
https://curl.se/docs/CVE-2025-10148.html
Import Source
https://curl.se/docs/CURL-CVE-2025-10148.json
JSON Data
https://api.test.osv.dev/v1/vulns/CURL-CVE-2025-10148
Aliases
Published
2025-09-10T08:00:00Z
Modified
2026-05-29T05:40:11.969734Z
Summary
predictable WebSocket mask
Details

curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection.

A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.

Database specific 
{
    "affects": "both",
    "last_affected": "8.15.0",
    "award": {
        "currency": "USD",
        "amount": "505"
    },
    "CWE": {
        "desc": "Generation of Predictable Numbers or Identifiers",
        "id": "CWE-340"
    },
    "URL": "https://curl.se/docs/CVE-2025-10148.json",
    "www": "https://curl.se/docs/CVE-2025-10148.html",
    "severity": "Low",
    "issue": "https://hackerone.com/reports/3330839",
    "package": "curl"
}
References
Credits
    • Calvin Ruocco (Vector Informatik GmbH) - FINDER
    • Daniel Stenberg - REMEDIATION_DEVELOPER

Affected packages

Git / github.com/curl/curl.git

Affected ranges

Type
SEMVER
Events
Introduced
8.11.0
Fixed
8.16.0
Type
GIT
Repo
https://github.com/curl/curl.git
Events
Introduced
d78e129d50b2d190f1c1bde2ad1f62f02f152db0
Fixed
84db7a9eae8468c0445b15aa806fa7fa806fa0f2

Affected versions

8.*
8.11.0
8.11.1
8.12.0
8.12.1
8.13.0
8.14.0
8.14.1
8.15.0
Other
curl-8_11_0
curl-8_11_1
curl-8_12_0
curl-8_12_1
curl-8_13_0
curl-8_14_0
curl-8_14_1
curl-8_15_0

Database specific

source 
"https://curl.se/docs/CURL-CVE-2025-10148.json"
vanir_signatures 
[
    {
        "target": {
            "file": "lib/ws.c"
        },
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "115754640541353332179368842763031201604",
                "25662696793809792373578077311744455491",
                "150869249084620197891002251454213456219",
                "290713789066388492121298202153574049867",
                "76649624789982854363314077649014518711",
                "339353784564679589688510580211241224860",
                "32249163427170650744730659881528487935",
                "230787691848753030490721405756064600432",
                "54168786194993705084096629222896816670",
                "91732389197285711550553457717979503220",
                "276519768724770070898311812105069169752",
                "80121419484267321853878387962221403799",
                "238268090342311044485122650596539568509",
                "126181613639975473066705350442729376067",
                "138946581227183152083883578096816448539",
                "188813354676990373552098884572904545181"
            ],
            "threshold": 0.9
        },
        "id": "CURL-CVE-2025-10148-0590ba99",
        "source": "https://github.com/curl/curl.git/commit/84db7a9eae8468c0445b15aa806fa7fa806fa0f2",
        "signature_version": "v1",
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "lib/ws.c",
            "function": "ws_enc_add_frame"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "176185201747501770228471716530421574573",
            "length": 2367.0
        },
        "id": "CURL-CVE-2025-10148-7a408de8",
        "source": "https://github.com/curl/curl.git/commit/84db7a9eae8468c0445b15aa806fa7fa806fa0f2",
        "signature_version": "v1",
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "lib/ws.c",
            "function": "Curl_ws_accept"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "17290471600654507478265332085082636517",
            "length": 2819.0
        },
        "id": "CURL-CVE-2025-10148-92437412",
        "source": "https://github.com/curl/curl.git/commit/84db7a9eae8468c0445b15aa806fa7fa806fa0f2",
        "signature_version": "v1",
        "signature_type": "Function"
    }
]
vanir_signatures_modified 
"2026-05-29T05:40:11Z"