cURL up to 8.15.0 WebSocket Mask generation of predictable numbers or identifiers

Summaryinfo

A vulnerability marked as problematic has been reported in cURL up to 8.15.0. This impacts an unknown function of the component WebSocket Mask. Performing a manipulation results in generation of predictable numbers or identifiers. This vulnerability is reported as CVE-2025-10148. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in cURL up to 8.15.0. This affects an unknown code of the component WebSocket Mask. The manipulation with an unknown input leads to a generation of predictable numbers or identifiers vulnerability. CWE is classifying the issue as CWE-340. The product uses a scheme that generates numbers or identifiers that are more predictable than required. The impact remains unknown. The summary by CVE is:

curl's websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.

It is possible to read the advisory at curl.se. This vulnerability is uniquely identified as CVE-2025-10148. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1600.001 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 264615 (SUSE SLES12 Security Update : curl (SUSE-SU-2025:03173-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 8.16.0 eliminates this vulnerability. The upgrade is hosted for download at curl.se. Applying the patch d78e129d50b2d1 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (264615), EUVD (EUVD-2025-29013) and CERT Bund (WID-SEC-2025-2023). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• IBM AIX
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• RESF Rocky Linux
• Dell Avamar
• NetApp Data ONTAP
• Open Source cURL
• NetApp ActiveIQ Unified Manager
• Dell NetWorker
• Dell Secure Connect Gateway
• Meinberg LANTIME
• HCL BigFix
• Tenable Security Nessus Network Monitor

Productinfo

Type

• Network Utility Software

Name

• cURL

Version

• 8.0
• 8.1
• 8.2
• 8.3
• 8.4
• 8.5
• 8.6
• 8.7
• 8.8
• 8.9
• 8.10
• 8.11
• 8.12
• 8.13
• 8.14
• 8.15.0

License

• open-source

Website

• Product: https://github.com/curl/curl/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion