CVE-2025-10148

curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://curl.se/docs/CVE-2025-10148.html	Patch Vendor Advisory
https://curl.se/docs/CVE-2025-10148.json	Vendor Advisory
https://hackerone.com/reports/3330839	Issue Tracking Third Party Advisory
http://www.openwall.com/lists/oss-security/2025/09/10/2	Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2025/09/10/3	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2025/09/10/4	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

History

19 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) El código websocket de curl no actualizó el patrón de máscara de 32 bits para cada nuevo frame saliente como indica la especificación. En su lugar, utilizó una máscara fija que persistió y se usó durante toda la conexión. Un patrón de máscara predecible permite que un servidor malicioso induzca tráfico entre las dos partes comunicantes que podría ser interpretado por un proxy involucrado (configurado o transparente) como tráfico HTTP genuino, real, con contenido y así envenenar su caché. Ese contenido envenenado en caché podría entonces ser servido a todos los usuarios de ese proxy.

Information

Published : 2025-09-12 06:15

Updated : 2026-10-19 17:10

NVD link : CVE-2025-10148

Mitre link : CVE-2025-10148

CVE.ORG link : CVE-2025-10148

JSON object : View

Products Affected

haxx

curl

CWE

CWE-340

Generation of Predictable Numbers or Identifiers

NVD-CWE-noinfo

{"id": "CVE-2025-10148", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10148", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-12T17:16:46.486840Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "affectedData": [{"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.11.0", "lessThan": "8.14.2", "versionType": "semver"}, {"status": "affected", "version": "8.15.0", "lessThan": "8.16.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"repo": "https://github.com/curl/curl.git", "vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "d78e129d50b2d190f1c1bde2ad1f62f02f152db0", "lessThan": "84db7a9eae8468c0445b15aa806fa7fa806fa0f2", "versionType": "git"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.15.0"}, {"status": "affected", "version": "8.14.1"}, {"status": "affected", "version": "8.14.0"}, {"status": "affected", "version": "8.13.0"}, {"status": "affected", "version": "8.12.1"}, {"status": "affected", "version": "8.12.0"}, {"status": "affected", "version": "8.11.1"}, {"status": "affected", "version": "8.11.0"}], "defaultStatus": "unaffected"}]}], "published": "2025-09-12T06:15:40.020", "references": [{"url": "https://curl.se/docs/CVE-2025-10148.html", "tags": ["Patch", "Vendor Advisory"], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}, {"url": "https://curl.se/docs/CVE-2025-10148.json", "tags": ["Vendor Advisory"], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}, {"url": "https://hackerone.com/reports/3330839", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}, {"url": "http://www.openwall.com/lists/oss-security/2025/09/10/2", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2025/09/10/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2025/09/10/4", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "2499f714-1537-4658-8207-48ae4bb9eae9", "description": [{"lang": "en", "value": "CWE-340"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy."}, {"lang": "es", "value": "El c\u00f3digo websocket de curl no actualiz\u00f3 el patr\u00f3n de m\u00e1scara de 32 bits para cada nuevo frame saliente como indica la especificaci\u00f3n. En su lugar, utiliz\u00f3 una m\u00e1scara fija que persisti\u00f3 y se us\u00f3 durante toda la conexi\u00f3n.\n\nUn patr\u00f3n de m\u00e1scara predecible permite que un servidor malicioso induzca tr\u00e1fico entre las dos partes comunicantes que podr\u00eda ser interpretado por un proxy involucrado (configurado o transparente) como tr\u00e1fico HTTP genuino, real, con contenido y as\u00ed envenenar su cach\u00e9. Ese contenido envenenado en cach\u00e9 podr\u00eda entonces ser servido a todos los usuarios de ese proxy."}], "lastModified": "2026-10-19T17:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A2D88104-00EB-4B8B-88D4-9FCCEF41FA6B", "versionEndExcluding": "8.16.0", "versionStartIncluding": "8.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9"}