cURL 8.13.0/8.14.0 WebSocket lib/ws.c curl_ws_send infinite loop

Summaryinfo

A vulnerability marked as problematic has been reported in cURL 8.13.0/8.14.0. This affects the function curl_ws_send of the file lib/ws.c of the component WebSocket Handler. This manipulation causes infinite loop. This vulnerability is tracked as CVE-2025-5399. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in cURL 8.13.0/8.14.0. Affected by this vulnerability is the function curl_ws_send of the file lib/ws.c of the component WebSocket Handler. The manipulation with an unknown input leads to a infinite loop vulnerability. The CWE definition for the vulnerability is CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. As an impact it is known to affect availability. The summary by CVE is:

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS libcurl-using application.

The advisory is shared at seclists.org. This vulnerability is known as CVE-2025-5399 since 05/31/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 240632 (Curl 8.13.0 < 8.14.1 DoS (CVE-2025-5399)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 8.14.1 eliminates this vulnerability. The upgrade is hosted for download at curl.se. Applying the patch d1145df24de8f80e6b16 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (240632), EUVD (EUVD-2025-17371) and CERT Bund (WID-SEC-2025-1567). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Red Hat Enterprise Linux
• Oracle MySQL
• Ubuntu Linux
• Oracle Linux
• RESF Rocky Linux
• Xerox FreeFlow Print Server

Productinfo

Type

• Network Utility Software

Name

• cURL

Version

• 8.13.0
• 8.14.0

License

• open-source

Website

• Product: https://github.com/curl/curl/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion