Every CVE Search/ Get API key

CVE-2025-5399

WebSocket endless loop

7.5 HighFix available

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.

There is no other way for the application to escape or exit this loop other than killing the thread/process.

This might be used to DoS libcurl-using application.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.44%Up 1.4 points since Jun 7, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.5

WebSocket endless loop

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.

There is no other way for the application to escape or exit this loop other than killing the thread/process.

This might be used to DoS libcurl-using application.

Record
CVE-2025-5399
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
EUVDEUVD-2025-17371 7.5

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.

There is no other way for the application to escape or exit this loop other than killing the thread/process.

This might be used to DoS libcurl-using application.

Record
EUVD-2025-17371
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-8h93-38hx-vv92 7.5

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted...

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.

There is no other way for the application to escape or exit this loop other than killing the thread/process.

This might be used to DoS libcurl-using application.

Record
GHSA-8h93-38hx-vv92
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
NVD 7.5

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.

There is no other way for the application to escape or exit this loop other than killing the thread/process.

This might be used to DoS libcurl-using application.

Record
CVE-2025-5399
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
OSVALPINE-CVE-2025-5399 7.5

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.

There is no other way for the application to escape or exit this loop other than killing the thread/process.

This might be used to DoS libcurl-using application.

Record
ALPINE-CVE-2025-5399
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2025-5399 7.5
Record
BELL-CVE-2025-5399
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 11 moreShow less
OSV 7.5

WebSocket endless loop

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.

There is no other way for the application to escape or exit this loop other than killing the thread/process.

This might be used to DoS libcurl-using application.

Record
CVE-2025-5399
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2025-5399 7.5

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS libcurl-using application.

Record
DEBIAN-CVE-2025-5399
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVJLSEC-2026-434 7.5

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted...

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.

There is no other way for the application to escape or exit this loop other than killing the thread/process.

This might be used to DoS libcurl-using application.

Record
JLSEC-2026-434
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2025:15699 6.5

Moderate: mysql-selinux and mysql8.4 security update

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.

Security Fix(es):

  • openssl: Timing side-channel in ECDSA signature computation (CVE-2024-13176)

  • mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722)

  • mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30688)

  • mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) (CVE-2025-30699)

  • mysql: UDF unspecified vulnerability (CPU Apr 2025) (CVE-2025-30721)

  • mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30682)

  • mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30683)

  • mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30715)

  • mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21574)

  • mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21585)

  • mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21588)

  • mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30681)

  • mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-21577)

  • mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30687)

  • mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21580)

  • mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30696)

  • mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30705)

  • mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21575)

  • mysql: Options unspecified vulnerability (CPU Apr 2025) (CVE-2025-21579)

  • mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30685)

  • mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30704)

  • mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21581)

  • mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30689)

  • mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30695)

  • mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30703)

  • mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693)

  • mysql: DDL unspecified vulnerability (CPU Apr 2025) (CVE-2025-21584)

  • mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30684)

  • curl: libcurl: WebSocket endless loop (CVE-2025-5399)

  • mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50092)

  • mysql: mysqldump unspecified vulnerability (CPU Jul 2025) (CVE-2025-50081)

  • mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50079)

  • mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50077)

  • mysql: DML unspecified vulnerability (CPU Jul 2025) (CVE-2025-50078)

  • mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50091)

  • mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50101)

  • mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50093)

  • mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50099)

  • mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50085)

  • mysql: Components Services unspecified vulnerability (CPU Jul 2025) (CVE-2025-50086)

  • mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50082)

  • mysql: Encryption unspecified vulnerability (CPU Jul 2025) (CVE-2025-50097)

  • mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50104)

  • mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50087)

  • mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) (CVE-2025-50080)

  • mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50088)

  • mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50083)

  • mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50084)

  • mysql: Thread…

Record
RLSA-2025:15699
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2025:15699 No score

Moderate: mysql-selinux and mysql8.4 security update

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.

Security Fix(es):

  • openssl: Timing side-channel in ECDSA signature computation (CVE-2024-13176)
  • mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722)
  • mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30688)
  • mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) (CVE-2025-30699)
  • mysql: UDF unspecified vulnerability (CPU Apr 2025) (CVE-2025-30721)
  • mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30682)
  • mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30683)
  • mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30715)
  • mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21574)
  • mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21585)
  • mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21588)
  • mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30681)
  • mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-21577)
  • mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30687)
  • mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21580)
  • mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30696)
  • mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30705)
  • mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21575)
  • mysql: Options unspecified vulnerability (CPU Apr 2025) (CVE-2025-21579)
  • mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30685)
  • mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30704)
  • mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21581)
  • mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30689)
  • mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30695)
  • mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30703)
  • mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693)
  • mysql: DDL unspecified vulnerability (CPU Apr 2025) (CVE-2025-21584)
  • mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30684)
  • curl: libcurl: WebSocket endless loop (CVE-2025-5399)
  • mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50092)
  • mysql: mysqldump unspecified vulnerability (CPU Jul 2025) (CVE-2025-50081)
  • mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50079)
  • mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50077)
  • mysql: DML unspecified vulnerability (CPU Jul 2025) (CVE-2025-50078)
  • mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50091)
  • mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50101)
  • mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50093)
  • mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50099)
  • mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50085)
  • mysql: Components Services unspecified vulnerability (CPU Jul 2025) (CVE-2025-50086)
  • mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50082)
  • mysql: Encryption unspecified vulnerability (CPU Jul 2025) (CVE-2025-50097)
  • mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50104)
  • mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50087)
  • mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) (CVE-2025-50080)
  • mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50088)
  • mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50083)
  • mysql: Optimizer unspecified…
Record
ALSA-2025:15699
Updated
2026-11-02
OSVALSA-2025:16046 No score

Moderate: mysql:8.4 security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

Security Fix(es):

  • openssl: Timing side-channel in ECDSA signature computation (CVE-2024-13176)
  • mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722)
  • mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30688)
  • mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) (CVE-2025-30699)
  • mysql: UDF unspecified vulnerability (CPU Apr 2025) (CVE-2025-30721)
  • mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30682)
  • mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30683)
  • mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30715)
  • mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21574)
  • mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21585)
  • mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21588)
  • mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30681)
  • mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-21577)
  • mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30687)
  • mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21580)
  • mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30696)
  • mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30705)
  • mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21575)
  • mysql: Options unspecified vulnerability (CPU Apr 2025) (CVE-2025-21579)
  • mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30685)
  • mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30704)
  • mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21581)
  • mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30689)
  • mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30695)
  • mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30703)
  • mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693)
  • mysql: DDL unspecified vulnerability (CPU Apr 2025) (CVE-2025-21584)
  • mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30684)
  • curl: libcurl: WebSocket endless loop (CVE-2025-5399)
  • mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50092)
  • mysql: mysqldump unspecified vulnerability (CPU Jul 2025) (CVE-2025-50081)
  • mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50079)
  • mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50077)
  • mysql: DML unspecified vulnerability (CPU Jul 2025) (CVE-2025-50078)
  • mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50091)
  • mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50101)
  • mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50093)
  • mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50099)
  • mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50085)
  • mysql: Components Services unspecified vulnerability (CPU Jul 2025) (CVE-2025-50086)
  • mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50082)
  • mysql: Encryption unspecified vulnerability (CPU Jul 2025) (CVE-2025-50097)
  • mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50104)
  • mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50087)
  • mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) (CVE-2025-50080)
  • mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50088)
  • mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50083)
  • mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50084)
  • mysql: Thread Pooling unspecified vulnerability (CPU Jul 2025) (CVE-2025-50100) *…
Record
ALSA-2025:16046
Updated
2026-11-02
OSVCLSA-2025-1766409829 No score

mysql: Fix of 33 CVEs

  • Update to MySQL 8.0.44 CVE-2025-53069 CVE-2025-53042 CVE-2025-53053 CVE-2025-53062 CVE-2025-53044 CVE-2025-53040 CVE-2025-53054 CVE-2025-53045
  • MySQL 8.0.43 CVE-2025-50078 CVE-2025-50082 CVE-2025-50083 CVE-2025-50085 CVE-2025-50077 CVE-2025-50088 CVE-2025-50092 CVE-2025-50099 CVE-2025-50086 CVE-2025-50093 CVE-2025-50094 CVE-2025-50079 CVE-2025-50084 CVE-2025-50087 CVE-2025-50091 CVE-2025-50101 CVE-2025-50102 CVE-2025-53023 CVE-2025-50097 CVE-2025-50080 CVE-2025-50096 CVE-2025-5399 CVE-2025-50104 CVE-2025-50098 CVE-2025-50100
Record
CLSA-2025-1766409829
Updated
2026-11-02
OSVCURL-CVE-2025-5399 No score

WebSocket endless loop

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.

There is no other way for the application to escape or exit this loop other than killing the thread/process.

This might be used to DoS libcurl-using application.

Record
CURL-CVE-2025-5399
Updated
2026-11-02
OSVopenSUSE-SU-2025:15213-1 No score

curl-8.14.1-4.1 on GA media

These are all security issues fixed in the curl-8.14.1-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15213-1
Updated
2026-11-02
OSVSUSE-SU-2025:03198-1 No score

Security update for curl

This update for curl fixes the following issues:

Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).

Security issues fixed:

  • CVE-2025-0665: eventfd double close can cause libcurl to act unreliably (bsc#1236589).
  • CVE-2025-4947: QUIC certificate check is skipped with wolfSSL allows for MITM attacks (bsc#1243397).
  • CVE-2025-5025: no QUIC certificate pinning with wolfSSL can lead to connections to impostor servers that are not easily noticed (bsc#1243706).
  • CVE-2025-5399: bug in websocket code can cause libcurl to get trapped in an endless busy-loop when processing specially crafted packets (bsc#1243933).
  • CVE-2024-6874: punycode conversions to/from IDN can leak stack content when libcurl is built to use the macidn IDN backend (bsc#1228260).
  • CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer (bsc#1249191).
  • CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).

Other issues fixed:

  • Fix wrong return code when --retry is used (bsc#1249367).

    • tool_operate: fix return code when --retry is used but not triggered [b42776b]

  • Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).

    • tool_getparam: fix --ftp-pasv [5f805ee]

  • Fixed with version 8.14.1:

    • TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.
    • websocket: add option to disable auto-pong reply.
    • huge number of bugfixes.

    Please see https://curl.se/ch/ for full changelogs.

Record
SUSE-SU-2025:03198-1
Updated
2026-11-02
OSVSUSE-SU-2025:20675-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2025-5399: libcurl can possibly get trapped in an endless busy-loop when processing specially crafted packets (bsc#1243933).
  • CVE-2025-5025: No QUIC certificate pinning with wolfSSL (bsc#1243706).
  • CVE-2025-4947: QUIC certificate check skip with wolfSSL (bsc#1243397).

Other bugfixes:

  • Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).
Record
SUSE-SU-2025:20675-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
curl
Alpine:v3.19
 8.13.0 up to 8.14.1-r0
8.14.1-r0
curl
Alpine:v3.20
 8.13.0 up to 8.14.1-r0
8.14.1-r0
curl
Alpine:v3.21
 8.13.0 up to 8.14.1-r0
8.14.1-r0
curl
Alpine:v3.22
 8.13.0 up to 8.14.1-r0
8.14.1-r0
curl
Alpine:v3.23
 8.13.0 up to 8.14.1-r0
8.14.1-r0
curl
Alpine:v3.24
 8.13.0 up to 8.14.1-r0
8.14.1-r0
mysql-selinux
AlmaLinux:10
From an advisory covering 53 CVEs
 before 1.0.14-1.el10_0
1.0.14-1.el10_0
mysql8.4-common
AlmaLinux:10
From an advisory covering 53 CVEs
 before 8.4.6-2.el10_0
8.4.6-2.el10_0
mysql8.4-errmsg
AlmaLinux:10
From an advisory covering 53 CVEs
 before 8.4.6-2.el10_0
8.4.6-2.el10_0
mysql8.4-test-data
AlmaLinux:10
From an advisory covering 53 CVEs
 before 8.4.6-2.el10_0
8.4.6-2.el10_0
Show 35 moreShow less
Affected packages
PackageAffectedFixed
mecab
AlmaLinux:9
From an advisory covering 53 CVEs
 before 0.996-3.module_el9.6.0+152+8cbce00c.4
0.996-3.module_el9.6.0+152+8cbce00c.4
mecab-devel
AlmaLinux:9
From an advisory covering 53 CVEs
 before 0.996-3.module_el9.6.0+152+8cbce00c.4
0.996-3.module_el9.6.0+152+8cbce00c.4
mecab-ipadic
AlmaLinux:9
From an advisory covering 53 CVEs
 before 2.7.0.20070801-24.module_el9.6.0+152+8cbce00c
2.7.0.20070801-24.module_el9.6.0+152+8cbce00c
mecab-ipadic-EUCJP
AlmaLinux:9
From an advisory covering 53 CVEs
 before 2.7.0.20070801-24.module_el9.6.0+152+8cbce00c
2.7.0.20070801-24.module_el9.6.0+152+8cbce00c
mysql
AlmaLinux:9
From an advisory covering 53 CVEs
 before 8.4.6-1.module_el9.6.0+180+a4e757e5
8.4.6-1.module_el9.6.0+180+a4e757e5
mysql-common
AlmaLinux:9
From an advisory covering 53 CVEs
 before 8.4.6-1.module_el9.6.0+180+a4e757e5
8.4.6-1.module_el9.6.0+180+a4e757e5
mysql-devel
AlmaLinux:9
From an advisory covering 53 CVEs
 before 8.4.6-1.module_el9.6.0+180+a4e757e5
8.4.6-1.module_el9.6.0+180+a4e757e5
mysql-errmsg
AlmaLinux:9
From an advisory covering 53 CVEs
 before 8.4.6-1.module_el9.6.0+180+a4e757e5
8.4.6-1.module_el9.6.0+180+a4e757e5
mysql-libs
AlmaLinux:9
From an advisory covering 53 CVEs
 before 8.4.6-1.module_el9.6.0+180+a4e757e5
8.4.6-1.module_el9.6.0+180+a4e757e5
mysql-server
AlmaLinux:9
From an advisory covering 53 CVEs
 before 8.4.6-1.module_el9.6.0+180+a4e757e5
8.4.6-1.module_el9.6.0+180+a4e757e5
mysql-test
AlmaLinux:9
From an advisory covering 53 CVEs
 before 8.4.6-1.module_el9.6.0+180+a4e757e5
8.4.6-1.module_el9.6.0+180+a4e757e5
mysql-test-data
AlmaLinux:9
From an advisory covering 53 CVEs
 before 8.4.6-1.module_el9.6.0+180+a4e757e5
8.4.6-1.module_el9.6.0+180+a4e757e5
rapidjson-devel
AlmaLinux:9
From an advisory covering 53 CVEs
 before 1.1.0-19.module_el9.6.0+152+8cbce00c
1.1.0-19.module_el9.6.0+152+8cbce00c
rapidjson-doc
AlmaLinux:9
From an advisory covering 53 CVEs
 before 1.1.0-19.module_el9.6.0+152+8cbce00c
1.1.0-19.module_el9.6.0+152+8cbce00c
curl
Alpaquita:25
 8.14.0-r1 up to 8.14.1-r1
8.14.1-r1
curl
Alpaquita:stream
 8.13.0-r0 up to 8.14.1-r1
8.14.1-r1
curl
BellSoft Hardened Containers:stream
 8.13.0-r0 up to 8.14.1-r1
8.14.1-r1
mysql
TuxCare:AlmaLinux:9.2
From an advisory covering 33 CVEs
 before 8.0.44-1.el9_2.tuxcare.els1
8.0.44-1.el9_2.tuxcare.els1
mysql-common
TuxCare:AlmaLinux:9.2
From an advisory covering 33 CVEs
 before 8.0.44-1.el9_2.tuxcare.els1
8.0.44-1.el9_2.tuxcare.els1
mysql-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 33 CVEs
 before 8.0.44-1.el9_2.tuxcare.els1
8.0.44-1.el9_2.tuxcare.els1
mysql-errmsg
TuxCare:AlmaLinux:9.2
From an advisory covering 33 CVEs
 before 8.0.44-1.el9_2.tuxcare.els1
8.0.44-1.el9_2.tuxcare.els1
mysql-libs
TuxCare:AlmaLinux:9.2
From an advisory covering 33 CVEs
 before 8.0.44-1.el9_2.tuxcare.els1
8.0.44-1.el9_2.tuxcare.els1
mysql-server
TuxCare:AlmaLinux:9.2
From an advisory covering 33 CVEs
 before 8.0.44-1.el9_2.tuxcare.els1
8.0.44-1.el9_2.tuxcare.els1
mysql-test
TuxCare:AlmaLinux:9.2
From an advisory covering 33 CVEs
 before 8.0.44-1.el9_2.tuxcare.els1
8.0.44-1.el9_2.tuxcare.els1
curl
Debian:13
 before 8.14.1-1
8.14.1-1
curl
Debian:14
 before 8.14.1-1
8.14.1-1
CURL_jll
Julia
 8.13.0+0 up to 8.14.1+0
8.14.1+0
LibCURL_jll
Julia
 8.13.0+0 up to 8.14.1+0
8.14.1+0
mysql8.4
Rocky Linux:10
From an advisory covering 53 CVEs
 before 0:8.4.6-2.el10_0
0:8.4.6-2.el10_0
mysql-selinux
Rocky Linux:10
From an advisory covering 53 CVEs
 before 0:1.0.14-1.el10_0
0:1.0.14-1.el10_0
curl
SUSE:Linux Enterprise Module for Basesystem 15 SP6
From an advisory covering 7 CVEs
 before 8.14.1-150600.4.28.1
8.14.1-150600.4.28.1
curl
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 7 CVEs
 before 8.14.1-150600.4.28.1
8.14.1-150600.4.28.1
curl
openSUSE:Leap 15.6
From an advisory covering 7 CVEs
 before 8.14.1-150600.4.28.1
8.14.1-150600.4.28.1
curl
SUSE:Linux Micro 6.1
From an advisory covering 3 CVEs
 before 8.14.1-slfo.1.1_1.1
8.14.1-slfo.1.1_1.1
curl
openSUSE:Tumbleweed
 before 8.14.1-4.1
8.14.1-4.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-5399 is a high vulnerability (CVSS 7.5) in Curl, published June 4, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.44%, the 73rd percentile. Fixed in curl 8.14.1-r0.

References

Show 186 moreShow less
This page doesn't list everything

Left out here: the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open