CURL-CVE-2025-5399
- Source
- https://curl.se/docs/CVE-2025-5399.html
- Import Source
- https://curl.se/docs/CURL-CVE-2025-5399.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CURL-CVE-2025-5399
- Aliases
- Published
- 2025-06-04T08:00:00Z
- Modified
- 2025-06-04T07:44:49Z
- Summary
- WebSocket endless loop
- Details
-
Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.
There is no other way for the application to escape or exit this loop other than killing the thread/process.
This might be used to DoS libcurl-using application.
- Database specific
{ "package": "curl", "award": { "currency": "USD", "amount": "505" }, "issue": "https://hackerone.com/reports/3168039", "CWE": { "id": "CWE-835", "desc": "Loop with Unreachable Exit Condition ('Infinite Loop')" }, "URL": "https://curl.se/docs/CVE-2025-5399.json", "last_affected": "8.14.0", "severity": "Low", "affects": "lib", "www": "https://curl.se/docs/CVE-2025-5399.html" }- References
-
- Credits
-
-
- z2_ on hackerone - FINDER
-
- z2_ on hackerone - REMEDIATION_DEVELOPER
-