{"id":"CVE-2025-10148","aliases":["ALPINE-CVE-2025-10148","AZL-67082","AZL-67272","AZL-67290","BELL-CVE-2025-10148","CURL-CVE-2025-10148","DEBIAN-CVE-2025-10148","EUVD-2025-29013","GHSA-cxvq-c3r3-8gwq","JLSEC-2026-423","RHSA-2026:6893","ROOT-OS-DEBIAN-12-CVE-2025-10148","SUSE-SU-2025:03173-1","SUSE-SU-2025:03198-1","SUSE-SU-2025:03267-1","SUSE-SU-2025:03268-1","SUSE-SU-2025:20802-1","SUSE-SU-2025:20824-1","SUSE-SU-2025:21077-1","SUSE-SU-2025:21145-1","UBUNTU-CVE-2025-10148","USN-8062-1","openSUSE-SU-2025:15590-1","openSUSE-SU-2025:20090-1"],"status":"published","title":"predictable WebSocket mask","description":"curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00524,"percentile":0.44731,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-340"],"published":"2025-09-10T08:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["8.14.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["8.14.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["8.14.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["8.14.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.16.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"curl","fixed_in":["8.11.1-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"curl","fixed_in":["8.8.0-7"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cmake","fixed_in":["3.30.3-10"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"curl","fixed_in":["8.9.1-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"curl","fixed_in":["8.14.1-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"curl","fixed_in":["8.16.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"curl","fixed_in":["8.16.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.88.1-10+deb12u15"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["8.14.1-2+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.16.0-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.16.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.16.0+0"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-curl","fixed_in":["7.88.1-10+deb12u14.root.io.11","7.88.1-10+deb12u14.root.io.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"curl","fixed_in":["8.5.0-2ubuntu10.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"curl","fixed_in":["8.14.1-2ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.11.0"},{"fixed":"8.14.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.11.0"},{"fixed":"8.14.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.11.0"},{"fixed":"8.14.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.11.0"},{"fixed":"8.14.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.11.0"},{"fixed":"8.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.11.0"},{"fixed":"8.16.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.1-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.0-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.3-10"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0-r2"},{"fixed":"8.9.1-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.14.0-r1"},{"fixed":"8.14.1-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.16.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.16.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10+deb12u15"}]}],"versions":["7.88.1-10","7.88.1-10+deb12u1","7.88.1-10+deb12u11","7.88.1-10+deb12u12","7.88.1-10+deb12u13","7.88.1-10+deb12u14","7.88.1-10+deb12u1~bpo11+1","7.88.1-10+deb12u2","7.88.1-10+deb12u3","7.88.1-10+deb12u3~bpo11+1","7.88.1-10+deb12u4","7.88.1-10+deb12u5","7.88.1-10+deb12u5~bpo11+1","7.88.1-10+deb12u6","7.88.1-10+deb12u6~bpo11+1","7.88.1-10+deb12u7","7.88.1-10+deb12u8","7.88.1-10+deb12u9"]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2+deb13u1"}]}],"versions":["8.14.1-2"]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.16.0-1"}]}],"versions":["8.14.1-2","8.14.1-2+exp1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1"]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.11.0+0"},{"fixed":"8.16.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.11.0+0"},{"fixed":"8.16.0+0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.19.0-3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.19.0-3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.19.0-3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.19.0-3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10+deb12u14.root.io.11"},{"fixed":"7.88.1-10+deb12u14.root.io.10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.108.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.108.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.28.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.28.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.28.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Installer Updates 15 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Installer Updates 15 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150200.4.91.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150200.4.91.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150200.4.91.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150200.4.91.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150200.4.91.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150200.4.91.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-slfo.1.1_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-2ubuntu10.7"}]}],"versions":["8.2.1-1ubuntu3","8.2.1-1ubuntu3.1","8.4.0-2ubuntu1","8.5.0-2ubuntu1","8.5.0-2ubuntu2","8.5.0-2ubuntu8","8.5.0-2ubuntu9","8.5.0-2ubuntu10","8.5.0-2ubuntu10.1","8.5.0-2ubuntu10.2","8.5.0-2ubuntu10.3","8.5.0-2ubuntu10.4","8.5.0-2ubuntu10.5","8.5.0-2ubuntu10.6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2ubuntu1.1"}]}],"versions":["8.12.1-3ubuntu1","8.13.0-5ubuntu1","8.14.1-1ubuntu2","8.14.1-1ubuntu3","8.14.1-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81.0-1ubuntu1.22"}]}],"versions":["7.74.0-1.3ubuntu2","7.74.0-1.3ubuntu3","7.80.0-3","7.81.0-1","7.81.0-1ubuntu1.1","7.81.0-1ubuntu1.2","7.81.0-1ubuntu1.3","7.81.0-1ubuntu1.4","7.81.0-1ubuntu1.6","7.81.0-1ubuntu1.7","7.81.0-1ubuntu1.8","7.81.0-1ubuntu1.10","7.81.0-1ubuntu1.11","7.81.0-1ubuntu1.13","7.81.0-1ubuntu1.14","7.81.0-1ubuntu1.15","7.81.0-1ubuntu1.16","7.81.0-1ubuntu1.17","7.81.0-1ubuntu1.18","7.81.0-1ubuntu1.19","7.81.0-1ubuntu1.20","7.81.0-1ubuntu1.21"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-2ubuntu10.7"}]}],"versions":["8.2.1-1ubuntu3","8.2.1-1ubuntu3.1","8.4.0-2ubuntu1","8.5.0-2ubuntu1","8.5.0-2ubuntu2","8.5.0-2ubuntu8","8.5.0-2ubuntu9","8.5.0-2ubuntu10","8.5.0-2ubuntu10.1","8.5.0-2ubuntu10.2","8.5.0-2ubuntu10.3","8.5.0-2ubuntu10.4","8.5.0-2ubuntu10.5","8.5.0-2ubuntu10.6"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2ubuntu1.1"}]}],"versions":["8.12.1-3ubuntu1","8.13.0-5ubuntu1","8.14.1-1ubuntu2","8.14.1-1ubuntu3","8.14.1-2ubuntu1"],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.16.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.3.1"}]}],"bundled":3}],"products":[{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"curl"}],"references":[{"url":"https://curl.se/docs/CVE-2025-10148.json","tags":["Vendor Advisory","web","article"]},{"url":"https://curl.se/docs/CVE-2025-10148.html","tags":["Patch","Vendor Advisory","web","article","report"]},{"url":"https://hackerone.com/reports/3330839","tags":["Issue Tracking","Third Party Advisory","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/10/2","tags":["Mailing List","Patch","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/10/3","tags":["Mailing List","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/10/4","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10148","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-cxvq-c3r3-8gwq","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-10148","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-10148","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10148.json","tags":["advisory"]},{"url":"https://github.com/curl/curl.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-10148","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6893","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9086","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-10148","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-10966","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15224","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15079","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14819","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14524","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-13034","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3805","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3783","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3784","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1965","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14017","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6893.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2394750","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9086","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9086","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2025-9086.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2025-9086.json","tags":["article"]},{"url":"https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb6","tags":["article"]},{"url":"https://hackerone.com/reports/3294999","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2394749","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-10148","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2413308","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-10966","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10966","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2025/11/05/2","tags":["article"]},{"url":"https://curl.se/docs/CVE-2025-10966.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2025-10966.json","tags":["article"]},{"url":"https://github.com/curl/curl/commit/b011e3fcfb06d6c027859","tags":["article"]},{"url":"https://hackerone.com/reports/3355218","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426406","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-13034","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13034","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2427870","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14017","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14017","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2025-14017.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2025-14017.json","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426407","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14524","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14524","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426408","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14819","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2025-14819.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426409","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15079","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15079","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426410","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15224","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15224","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446448","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1965","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1965","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-1965.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-1965.json","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446450","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3783","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/11/2","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3783.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3783.json","tags":["article"]},{"url":"https://hackerone.com/reports/3583983","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446449","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3784","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3784","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/11/3","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3784.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3784.json","tags":["article"]},{"url":"https://hackerone.com/reports/3584903","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446451","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3805","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3805","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/11/4","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3805.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3805.json","tags":["article"]},{"url":"https://hackerone.com/reports/3591944","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503173-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249191","tags":["report"]},{"url":"https://bugzilla.suse.com/1249348","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9086","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503198-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228260","tags":["report"]},{"url":"https://bugzilla.suse.com/1236589","tags":["report"]},{"url":"https://bugzilla.suse.com/1243397","tags":["report"]},{"url":"https://bugzilla.suse.com/1243706","tags":["report"]},{"url":"https://bugzilla.suse.com/1243933","tags":["report"]},{"url":"https://bugzilla.suse.com/1246197","tags":["report"]},{"url":"https://bugzilla.suse.com/1249367","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5399","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503267-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503268-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520802-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520824-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521077-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253757","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11563","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521145-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-10148","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8062-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-9086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-11563","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-13034","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-14017","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-14524","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-14819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-15079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-15224","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-10148","title":"predictable WebSocket mask","description":"curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy.","status":"published","published":"2025-09-12T05:10:37.469Z","modified":"2026-09-15T06:02:23.283Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-340"],"updated_at":"2026-11-02T14:32:30.643267Z"}],"euvd":[{"id":"EUVD-2025-29013","description":"curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy.","status":"published","published":"2025-09-12T05:10:37Z","modified":"2026-09-15T06:02:23Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:19.01786Z"}],"ghsa":[{"id":"GHSA-cxvq-c3r3-8gwq","title":"curl's websocket code did not update the 32 bit mask pattern for each new\n outgoing frame as the...","description":"curl's websocket code did not update the 32 bit mask pattern for each new\n outgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy.","status":"published","published":"2025-09-12T06:30:26Z","modified":"2026-09-15T09:31:29Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-340"],"updated_at":"2026-11-02T15:11:53.5286Z"}],"nvd":[{"id":"CVE-2025-10148","description":"curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy.","status":"published","published":"2025-09-12T06:15:40.02Z","modified":"2026-10-19T17:10:00.173Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-340"],"updated_at":"2026-11-02T14:11:28.834562Z"}],"osv":[{"id":"ALPINE-CVE-2025-10148","description":"curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy.","status":"published","published":"2025-09-12T06:15:40.02Z","modified":"2026-09-16T08:30:04.545997549Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2025-10148","status":"published","published":"2025-09-11T11:33:53.548891Z","modified":"2026-01-26T09:41:21.451937Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"CVE-2025-10148","title":"predictable WebSocket mask","description":"curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy.","status":"published","published":"2025-09-12T05:10:37.469Z","modified":"2026-10-28T10:58:57.262742815Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-340"],"updated_at":"2026-11-02T15:44:45.712478Z"},{"id":"DEBIAN-CVE-2025-10148","description":"curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection.  A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.","status":"published","published":"2025-09-12T06:15:40.02Z","modified":"2026-10-23T17:47:26.933753953Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"JLSEC-2026-423","title":"curl's websocket code did not update the 32 bit mask pattern for each new outgoing frame as the...","description":"curl's websocket code did not update the 32 bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy.","status":"published","published":"2026-05-04T13:12:06.605Z","modified":"2026-07-18T00:01:59.565012834Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"RHSA-2026:6893","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:10:50Z","modified":"2026-10-16T10:23:46Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"UBUNTU-CVE-2025-10148","description":"curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.","status":"published","published":"2025-09-12T06:15:00Z","modified":"2026-10-28T20:15:19.708059086Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"AZL-67082","title":"CVE-2025-10148 affecting package curl for versions less than 8.11.1-4","description":"curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy.","status":"published","published":"2025-09-12T06:15:40Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:23.841127Z"},{"id":"AZL-67272","title":"CVE-2025-10148 affecting package curl for versions less than 8.8.0-7","description":"curl's websocket code did not update the 32 bit mask pattern for each new\n outgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy.","status":"published","published":"2025-09-12T06:15:40Z","modified":"2026-04-21T04:38:07.555871Z","updated_at":"2026-11-02T15:28:08.354547Z"},{"id":"AZL-67290","title":"CVE-2025-10148 affecting package cmake for versions less than 3.30.3-10","description":"curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy.","status":"published","published":"2025-09-12T06:15:40Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:23.841127Z"},{"id":"CURL-CVE-2025-10148","title":"predictable WebSocket mask","description":"curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy.","status":"published","published":"2025-09-10T08:00:00Z","modified":"2026-10-25T01:05:18.164838373Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"openSUSE-SU-2025:15590-1","title":"curl-8.16.0-1.1 on GA media","description":"These are all security issues fixed in the curl-8.16.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-01T00:00:00Z","modified":"2026-03-23T04:53:58.730295Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:20090-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191)\n- CVE-2025-11563: Fixed wcurl path traversal with percent-encoded slashes (bsc#1253757)\n- CVE-2025-10148: Fixed predictable WebSocket mask (bsc#1249348)\n\nOther fixes:\n- tool_operate: fix return code when --retry is used but not\n  triggered (bsc#1249367)\n","status":"published","published":"2025-11-26T14:30:14Z","modified":"2026-03-23T04:54:16.757459Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2025-10148","title":"CVE-2025-10148 in rootio-curl - Patched by Root","description":"Root has patched CVE-2025-10148 in the rootio-curl package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-07-09T08:22:17Z","modified":"2026-07-28T19:36:32.708035267Z","updated_at":"2026-11-02T15:53:30.983521Z"},{"id":"SUSE-SU-2025:03173-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2025-9086: bug in path comparison logic when processing cookies can lead to out-of-bounds read in heap buffer\n  (bsc#1249191).\n- CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).\n","status":"published","published":"2025-09-11T12:55:00Z","modified":"2026-03-23T04:48:00.128721Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03198-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nUpdate to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).    \n    \nSecurity issues fixed:\n\n- CVE-2025-0665: eventfd double close can cause libcurl to act unreliably (bsc#1236589).\n- CVE-2025-4947: QUIC certificate check is skipped with wolfSSL allows for MITM attacks (bsc#1243397).\n- CVE-2025-5025: no QUIC certificate pinning with wolfSSL can lead to connections to impostor servers that are not\n  easily noticed (bsc#1243706).\n- CVE-2025-5399: bug in websocket code can cause libcurl to get trapped in an endless busy-loop when processing\n  specially crafted packets (bsc#1243933).\n- CVE-2024-6874: punycode conversions to/from IDN can leak stack content when libcurl is built to use the macidn IDN\n  backend (bsc#1228260).\n- CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer\n  (bsc#1249191).\n- CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).\n\nOther issues fixed:\n    \n- Fix wrong return code when --retry is used (bsc#1249367).\n  * tool_operate: fix return code when --retry is used but not triggered [b42776b]\n    \n- Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).\n  * tool_getparam: fix --ftp-pasv [5f805ee]\n\n- Fixed with version 8.14.1:\n  * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.\n  * websocket: add option to disable auto-pong reply.\n  * huge number of bugfixes.\n\n  Please see https://curl.se/ch/ for full changelogs.\n","status":"published","published":"2025-09-12T12:15:10Z","modified":"2026-03-23T04:50:28.709496Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03267-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer\n  (bsc#1249191).\n- CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).\n    \nOther issues fixed:\n    \n- Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).\n  * tool_getparam: fix --ftp-pasv [5f805ee]\n\n- Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).\n  * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.\n  * websocket: add option to disable auto-pong reply.\n  * huge number of bugfixes.\n\n  Please see https://curl.se/ch/ for full changelogs.\n","status":"published","published":"2025-09-18T11:06:28Z","modified":"2026-02-04T03:59:16.877302Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03268-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer\n  (bsc#1249191).\n- CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).\n    \nOther issues fixed:\n    \n- Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).\n  * tool_getparam: fix --ftp-pasv [5f805ee]\n\n- Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).\n  * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.\n  * websocket: add option to disable auto-pong reply.\n  * huge number of bugfixes.\n\n  Please see https://curl.se/ch/ for full changelogs.\n\n","status":"published","published":"2025-09-18T11:08:43Z","modified":"2026-02-04T03:08:47.033591Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:20802-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- tool_operate: fix return code when --retry is used but not\n  triggered [bsc#1249367]\n\n- Security fixes:\n  \n  * CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191)\n  * CVE-2025-10148: Fixed predictable WebSocket mask (bsc#1249348)\n","status":"published","published":"2025-09-26T09:20:48Z","modified":"2026-03-23T04:49:04.774409Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20824-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191)\n- CVE-2025-10148: Predictable WebSocket mask (bsc#1249348)\n- Fix the --ftp-pasv option in curl v8.14.1 [bsc#1246197]\n- tool_operate: fix return code when --retry is used but not\n  triggered [bsc#1249367]\n\n- Updated to 8.14.1: [jsc#PED-13055, jsc#PED-13056]\n  * Add _multibuild\n  * Bugfixes:\n    - asyn-thrdd: fix cleanup when RR fails due to OOM\n    - ftp: fix teardown of DATA connection in done\n    - http: fail early when rewind of input failed when following redirects\n    - multi: fix add_handle resizing\n    - tls BIOs: handle BIO_CTRL_EOF correctly\n    - tool_getparam: make --no-anyauth not be accepted\n    - wolfssl: fix sending of early data\n    - ws: handle blocked sends better\n    - ws: tests and fixes\n\n- Sync spec file with SLE codestreams: [jsc#PED-13055, jsc#PED-13056]\n  \n  * Add curl-mini.rpmlintrc to avoid rpmlint shlib-policy-name-error\n    when building the curl-mini package in SLE.\n  * Add libssh minimum version requirements.\n  * Use ldconfig_scriptlets when available.\n  * Remove unused option --disable-ntlm-wb.\n\n- Update to 8.14.0:\n  \n  * Changes:\n    - mqtt: send ping at upkeep interval\n    - schannel: handle pkcs12 client certificates containing CA certificates\n    - TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs\n    - vquic: ngtcp2 + openssl support\n    - wcurl: import v2025.04.20 script + docs\n    - websocket: add option to disable auto-pong reply\n  \n  * Bugfixes:\n    - asny-thrdd: fix detach from running thread\n    - async-threaded resolver: use ref counter\n    - async: DoH improvements\n    - build: enable gcc-12/13+, clang-10+ picky warnings\n    - build: enable gcc-15 picky warnings\n    - certs: drop unused `default_bits` from `.prm` files\n    - cf-https-connect: use the passed in dns struct pointer\n    - cf-socket: fix FTP accept connect\n    - cfilters: remove assert\n    - cmake: fix nghttp3 static linking with `USE_OPENSSL_QUIC=ON`\n    - cmake: prefer `COMPILE_OPTIONS` over `CMAKE_C_FLAGS` for custom C options\n    - cmake: revert `CURL_LTO` behavior for multi-config generators\n    - configure: fix --disable-rt\n    - CONTRIBUTE: add project guidelines for AI use\n    - cpool/cshutdown: force close connections under pressure\n    - curl: fix memory leak when -h is used in config file\n    - curl_get_line: handle lines ending on the buffer boundary\n    - headers: enforce a max number of response header to accept\n    - http: fix HTTP/2 handling of TE request header using \"trailers\"\n    - lib: include files using known path\n    - lib: unify conversions to/from hex\n    - libssh: add NULL check for Curl_meta_get()\n    - libssh: fix memory leak\n    - mqtt: use conn/easy meta hash\n    - multi: do transfer book keeping using mid\n    - multi: init_do(): check result\n    - netrc: avoid NULL deref on weird input\n    - netrc: avoid strdup NULL\n    - netrc: deal with null token better\n    - openssl-quic: avoid potential `-Wnull-dereference`, add assert\n    - openssl-quic: fix shutdown when stream not open\n    - openssl: enable builds for *both* engines and providers\n    - openssl: set the cipher string before doing private cert\n    - progress: avoid integer overflow when gathering total transfer size\n    - rand: update comment on Curl_rand_bytes weak random\n    - rustls: make max size of cert and key reasonable\n    - smb: avoid integer overflow on weird input date\n    - urlapi: redirecting to \"\" is considered fine\n\n- Update to 8.13.0:\n  \n  * Changes:\n    - curl: add write-out variable 'tls_earlydata'\n    - curl: make --url support a file with URLs\n    - gnutls: set priority via --ciphers\n    - IMAP: add CURLOPT_UPLOAD_FLAGS and --upload-flags\n    - lib: add CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY\n    - OpenSSL/quictls: add support for TLSv1.3 early data\n    - rustls: add support for CERTINFO\n    - rustls: add support for SSLKEYLOGFILE\n    - rustls: support ECH w/ DoH lookup for config\n    - rustls: support native platform verifier\n    - var: add a '64dec' function that can base64 decode a string\n  \n  * Bugfixes:\n    - conn: fix connection reuse when SSL is optional\n    - hash: use single linked list for entries\n    - http2: detect session being closed on ingress handling\n    - http2: reset stream on response header error\n    - http: remove a HTTP method size restriction\n    - http: version negotiation\n    - httpsrr: fix port detection\n    - libssh: fix freeing of resources in disconnect\n    - libssh: fix scp large file upload for 32-bit size_t systems\n    - openssl-quic: do not iterate over multi handles\n    - openssl: check return value of X509_get0_pubkey\n    - openssl: drop support for old OpenSSL/LibreSSL versions\n    - openssl: fix crash on missing cert password\n    - openssl: fix pkcs11 URI checking for key files.\n    - openssl: remove bad `goto`s into other scope\n    - setopt: illegal CURLOPT_SOCKS5_AUTH should return error\n    - setopt: setting PROXYUSERPWD after PROXYUSERNAME/PASSWORD is fine\n    - sshserver.pl: adjust `AuthorizedKeysFile2` cutoff version\n    - sshserver: fix excluding obsolete client config lines\n    - SSLCERTS: list support for SSL_CERT_FILE and SSL_CERT_DIR\n    - tftpd: prefix TFTP protocol error `E*` constants with `TFTP_`\n    - tool_operate: fail SSH transfers without server auth\n    - url: call protocol handler's disconnect in Curl_conn_free\n    - urlapi: remove percent encoded dot sequences from the URL path\n    - urldata: remove 'hostname' from struct Curl_async\n\n- Update to 8.12.1:\n  \n  * Bugfixes:\n    - asyn-thread: fix build with 'CURL_DISABLE_SOCKETPAIR'\n    - asyn-thread: fix HTTPS RR crash\n    - asyn-thread: fix the returned bitmask from Curl_resolver_getsock\n    - asyn-thread: survive a c-ares channel set to NULL\n    - cmake: always reference OpenSSL and ZLIB via imported targets\n    - cmake: respect 'GNUTLS_CFLAGS' when detected via 'pkg-config'\n    - cmake: respect 'GNUTLS_LIBRARY_DIRS' in 'libcurl.pc' and 'curl-config'\n    - content_encoding: #error on too old zlib\n    - imap: TLS upgrade fix\n    - ldap: drop support for legacy Novell LDAP SDK\n    - libssh2: comparison is always true because rc \u003c= -1\n    - libssh2: raise lowest supported version to 1.2.8\n    - libssh: drop support for libssh older than 0.9.0\n    - openssl-quic: ignore ciphers for h3\n    - pop3: TLS upgrade fix\n    - runtests: fix the disabling of the memory tracking\n    - runtests: quote commands to support paths with spaces\n    - scache: add magic checks\n    - smb: silence '-Warray-bounds' with gcc 13+\n    - smtp: TLS upgrade fix\n    - tool_cfgable: sort struct fields by size, use bitfields for booleans\n    - tool_getparam: add \"TLS required\" flag for each such option\n    - vtls: fix multissl-init\n    - wakeup_write: make sure the eventfd write sends eight bytes\n\n- Update to 8.12.0:\n  \n  * Changes:\n    - curl: add byte range support to --variable reading from file\n    - curl: make --etag-save acknowledge --create-dirs\n    - getinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var\n    - getinfo: provide info which auth was used for HTTP and proxy\n    - hyper: drop support\n    - openssl: add support to use keys and certificates from PKCS#11 provider\n    - QUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA\n    - vtls: feature ssls-export for SSL session im-/export\n  \n  * Bugfixes:\n    - altsvc: avoid integer overflow in expire calculation\n    - asyn-ares: acknowledge CURLOPT_DNS_SERVERS set to NULL\n    - asyn-ares: fix memory leak\n    - asyn-ares: initial HTTPS resolve support\n    - asyn-thread: use c-ares to resolve HTTPS RR\n    - async-thread: avoid closing eventfd twice\n    - cd2nroff: do not insist on quoted \u003c\u003e within backticks\n    - cd2nroff: support \"none\" as a TLS backend\n    - conncache: count shutdowns against host and max limits\n    - content_encoding: drop support for zlib before 1.2.0.4\n    - content_encoding: namespace GZIP flag constants\n    - content_encoding: put the decomp buffers into the writer structs\n    - content_encoding: support use of custom libzstd memory functions\n    - cookie: cap expire times to 400 days\n    - cookie: parse only the exact expire date\n    - curl: return error if etag options are used with multiple URLs\n    - curl_multi_fdset: include the shutdown connections in the set\n    - curl_sha512_256: rename symbols to the curl namespace\n    - curl_url_set.md: adjust the added-in to 7.62.0\n    - doh: send HTTPS RR requests for all HTTP(S) transfers\n    - easy: allow connect-only handle reuse with easy_perform\n    - easy: make curl_easy_perform() return error if connection still there\n    - easy_lock: use Sleep(1) for thread yield on old Windows\n    - ECH: update APIs to those agreed with OpenSSL maintainers\n    - GnuTLS: fix 'time_appconnect' for early data\n    - HTTP/2: strip TE request header\n    - http2: fix data_pending check\n    - http2: fix value stored to 'result' is never read\n    - http: ignore invalid Retry-After times\n    - http_aws_sigv4: Fix invalid compare function handling zero-length pairs\n    - https-connect: start next immediately on failure\n    - lib: redirect handling by protocol handler\n    - multi: fix curl_multi_waitfds reporting of fd_count\n    - netrc: 'default' with no credentials is not a match\n    - netrc: fix password-only entries\n    - netrc: restore _netrc fallback logic\n    - ngtcp2: fix memory leak on connect failure\n    - openssl: define `HAVE_KEYLOG_CALLBACK` before use\n    - openssl: fix ECH logic\n    - osslq: use SSL_poll to determine writeability of QUIC streams\n    - sectransp: free certificate on error\n    - select: avoid a NULL deref in cwfds_add_sock\n    - src: omit hugehelp and ca-embed from libcurltool\n    - ssl session cache: change cache dimensions\n    - system.h: add 64-bit curl_off_t definitions for NonStop\n    - telnet: handle single-byte input option\n    - TLS: check connection for SSL use, not handler\n    - tool_formparse.c: make curlx_uztoso a static in here\n    - tool_formparse: accept digits in --form type= strings\n    - tool_getparam: ECH param parsing refix\n    - tool_getparam: fail --hostpubsha256 if libssh2 is not used\n    - tool_getparam: fix \"Ignored Return Value\"\n    - tool_getparam: fix memory leak on error in parse_ech\n    - tool_getparam: fix the ECH parser\n    - tool_operate: make --etag-compare always accept a non-existing file\n    - transfer: fix CURLOPT_CURLU override logic\n    - urlapi: fix redirect to a new fragment or query (only)\n    - vquic: make vquic_send_packets not return without setting psent\n    - vtls: fix default SSL backend as a fallback\n    - vtls: only remember the expiry timestamp in session cache\n    - websocket: fix message send corruption\n    - x509asn1: add parse recursion limit\n","status":"published","published":"2025-09-25T10:52:04Z","modified":"2026-03-23T04:47:19.583665Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:21077-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191)\n- CVE-2025-11563: Fixed wcurl path traversal with percent-encoded slashes (bsc#1253757)\n- CVE-2025-10148: Fixed predictable WebSocket mask (bsc#1249348)\n\nOther fixes:\n- tool_operate: fix return code when --retry is used but not\n  triggered (bsc#1249367)\n","status":"published","published":"2025-11-26T14:28:47Z","modified":"2026-03-23T04:51:10.319584Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:21145-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191)\n- CVE-2025-11563: Fixed wcurl path traversal with percent-encoded slashes (bsc#1253757)\n- CVE-2025-10148: Fixed predictable WebSocket mask (bsc#1249348)\n\nOther fixes:\n- tool_operate: fix return code when --retry is used but not\n  triggered (bsc#1249367)\n","status":"published","published":"2025-11-26T14:28:47Z","modified":"2026-03-23T04:51:14.109641Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"USN-8062-1","title":"curl vulnerabilities","description":"It was discovered that curl incorrectly handled cookies when redirected\nfrom secure to insecure connections. An attacker could possibly use this\nissue to cause a denial of service, or obtain sensitive information.\nThis issue only affected Ubuntu 25.10. (CVE-2025-9086)\n\nCalvin Ruocco discovered that curl did not properly handle WebSocket\ncommunications under certain circumstances. A malicious server could\npossibly use this issue to poison proxy caches with malicious content.\nThis issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10.\n(CVE-2025-10148)\n\nStanislav Fort discovered that wcurl did not properly handle URLs with\ncertain encoded characters. If a user were tricked into processing\na specially crafted URL, an attacker could possibly use this issue to\nwrite files outside the intended directory. This issue only affected\nUbuntu 25.10. (CVE-2025-11563)\n\nStanislav Fort discovered that curl did not properly validate pinned\npublic keys under certain circumstances. A remote attacker could\npossibly use this issue to perform a machine-in-the-middle attack. This\nissue only affected Ubuntu 25.10.(CVE-2025-13034)\n\nStanislav Fort discovered that curl did not properly manage TLS options\nwhen performing LDAP over TLS transfers in multi-threaded environments.\nUnder certain circumstances, certificate verification could be\nunintentionally and unknowingly disabled. (CVE-2025-14017)\n\nIt was discovered that curl incorrectly handled Oauth2 bearer tokens\nwhen following redirects. A remote attacker could possibly use this\nissue to obtain authentication credentials. (CVE-2025-14524)\n\nStanislav Fort discovered that curl did not properly validate TLS\ncertificates when reusing connections. A remote attacker could possibly\nuse this issue to bypass expected certificate verification. This issue\nonly affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-14819)\n\nHarry Sintonen discovered that curl did not properly validate SSH host\nkeys when performing SSH-based file transfers. This issue could lead to\nunintended bypass of custom known_hosts file. This issue only\naffected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-15079)\n\nHarry Sintonen discovered that curl built with libssh did not properly\nhandle authentication when performing SSH-based file transfers. This\ncould result in unintended authentication operations. This issue only\naffected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-15224)","status":"published","published":"2026-02-25T00:34:27Z","modified":"2026-04-27T18:47:19.528380495Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}