{"id":"CVE-2025-5399","aliases":["ALPINE-CVE-2025-5399","ALSA-2025:15699","ALSA-2025:16046","BELL-CVE-2025-5399","CLSA-2025-1766409829","CURL-CVE-2025-5399","DEBIAN-CVE-2025-5399","EUVD-2025-17371","GHSA-8h93-38hx-vv92","JLSEC-2026-434","RLSA-2025:15699","SUSE-SU-2025:03198-1","SUSE-SU-2025:20675-1","openSUSE-SU-2025:15213-1"],"status":"published","title":"WebSocket endless loop","description":"Due to a mistake in libcurl's WebSocket code, a malicious server can send a\nparticularly crafted packet which makes libcurl get trapped in an endless\nbusy-loop.\n\nThere is no other way for the application to escape or exit this loop other\nthan killing the thread/process.\n\nThis might be used to DoS libcurl-using application.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.01435,"percentile":0.73322,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2025-06-04T08:00:00Z","modified":"2026-10-29T11:32:28Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["8.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["8.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["8.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["8.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"curl","fixed_in":["8.14.1-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"curl","fixed_in":["8.14.1-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"curl","fixed_in":["8.14.1-r1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["8.14.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.14.1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.14.1+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.14.1+0"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"curl","fixed_in":["8.14.1-4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.13.0"},{"fixed":"8.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.13.0"},{"fixed":"8.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.13.0"},{"fixed":"8.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.13.0"},{"fixed":"8.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.13.0"},{"fixed":"8.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.13.0"},{"fixed":"8.14.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"mysql-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-1.el10_0"}]}],"bundled":53},{"source":"osv","ecosystem":"AlmaLinux:10","package":"mysql8.4-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.6-2.el10_0"}]}],"bundled":53},{"source":"osv","ecosystem":"AlmaLinux:10","package":"mysql8.4-errmsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.6-2.el10_0"}]}],"bundled":53},{"source":"osv","ecosystem":"AlmaLinux:10","package":"mysql8.4-test-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.6-2.el10_0"}]}],"bundled":53},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mecab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.996-3.module_el9.6.0+152+8cbce00c.4"}]}],"bundled":53},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mecab-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.996-3.module_el9.6.0+152+8cbce00c.4"}]}],"bundled":53},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mecab-ipadic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0.20070801-24.module_el9.6.0+152+8cbce00c"}]}],"bundled":53},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mecab-ipadic-EUCJP","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0.20070801-24.module_el9.6.0+152+8cbce00c"}]}],"bundled":53},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.6-1.module_el9.6.0+180+a4e757e5"}]}],"bundled":53},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mysql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.6-1.module_el9.6.0+180+a4e757e5"}]}],"bundled":53},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mysql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.6-1.module_el9.6.0+180+a4e757e5"}]}],"bundled":53},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mysql-errmsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.6-1.module_el9.6.0+180+a4e757e5"}]}],"bundled":53},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mysql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.6-1.module_el9.6.0+180+a4e757e5"}]}],"bundled":53},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mysql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.6-1.module_el9.6.0+180+a4e757e5"}]}],"bundled":53},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mysql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.6-1.module_el9.6.0+180+a4e757e5"}]}],"bundled":53},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mysql-test-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.6-1.module_el9.6.0+180+a4e757e5"}]}],"bundled":53},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rapidjson-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-19.module_el9.6.0+152+8cbce00c"}]}],"bundled":53},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rapidjson-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-19.module_el9.6.0+152+8cbce00c"}]}],"bundled":53},{"source":"osv","ecosystem":"Alpaquita:25","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.14.0-r1"},{"fixed":"8.14.1-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.13.0-r0"},{"fixed":"8.14.1-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.13.0-r0"},{"fixed":"8.14.1-r1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.44-1.el9_2.tuxcare.els1"}]}],"bundled":33},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mysql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.44-1.el9_2.tuxcare.els1"}]}],"bundled":33},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mysql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.44-1.el9_2.tuxcare.els1"}]}],"bundled":33},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mysql-errmsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.44-1.el9_2.tuxcare.els1"}]}],"bundled":33},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mysql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.44-1.el9_2.tuxcare.els1"}]}],"bundled":33},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mysql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.44-1.el9_2.tuxcare.els1"}]}],"bundled":33},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mysql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.44-1.el9_2.tuxcare.els1"}]}],"bundled":33},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.13.0+0"},{"fixed":"8.14.1+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.13.0+0"},{"fixed":"8.14.1+0"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"mysql8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.6-2.el10_0"}]}],"bundled":53},{"source":"osv","ecosystem":"Rocky Linux:10","package":"mysql-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.14-1.el10_0"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.28.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.28.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.28.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-slfo.1.1_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-4.1"}]}]}],"products":[{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"curl"}],"references":[{"url":"https://curl.se/docs/CVE-2025-5399.json","tags":["Vendor Advisory","web"]},{"url":"https://curl.se/docs/CVE-2025-5399.html","tags":["Vendor Advisory","web"]},{"url":"https://hackerone.com/reports/3168039","tags":["Exploit","Issue Tracking","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/06/04/2","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5399","tags":["advisory","web"]},{"url":"https://github.com/advisories/GHSA-8h93-38hx-vv92","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-5399","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:15699","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-13176","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21574","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21575","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21577","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21579","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21580","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21581","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21584","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21585","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21588","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30681","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30682","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30683","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30684","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30685","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30687","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30688","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30689","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30693","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30695","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30696","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30699","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30703","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30704","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30705","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30715","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30721","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30722","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50077","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50078","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50079","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50080","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50081","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50082","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50083","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50084","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50085","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50086","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50087","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50088","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50091","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50092","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50093","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50094","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50096","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50097","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50098","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50099","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50100","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50101","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50102","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-50104","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-5399","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359885","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359888","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359892","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359894","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359895","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359899","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359900","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359902","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359903","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359911","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359918","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359920","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359924","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359928","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359930","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359932","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359934","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359938","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359940","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359943","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359944","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359945","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359947","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359950","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359963","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359964","tags":["report"]},{"url":"https://bugzilla.redhat.com/2359972","tags":["report"]},{"url":"https://bugzilla.redhat.com/2370920","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380264","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380273","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380274","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380278","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380280","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380283","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380284","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380290","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380291","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380295","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380298","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380306","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380308","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380309","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380310","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380312","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380313","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380320","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380321","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380322","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380326","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380327","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380334","tags":["report"]},{"url":"https://bugzilla.redhat.com/2380335","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-15699.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:16046","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-16046.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-5399","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1766409829.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5399.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-5399","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:15699","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2338999","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359885","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359888","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359892","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359894","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359895","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359899","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359900","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359902","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359903","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359911","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359918","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359920","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359924","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359930","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359932","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359940","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359943","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359944","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359945","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359947","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359950","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359963","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359964","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359972","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2370920","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380264","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380273","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380274","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380278","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380280","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380284","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380290","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380291","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380295","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380298","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380308","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380309","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380312","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380313","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380320","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380322","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380326","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380327","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380334","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380335","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503198-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228260","tags":["report"]},{"url":"https://bugzilla.suse.com/1236589","tags":["report"]},{"url":"https://bugzilla.suse.com/1243397","tags":["report"]},{"url":"https://bugzilla.suse.com/1243706","tags":["report"]},{"url":"https://bugzilla.suse.com/1243933","tags":["report"]},{"url":"https://bugzilla.suse.com/1246197","tags":["report"]},{"url":"https://bugzilla.suse.com/1249191","tags":["report"]},{"url":"https://bugzilla.suse.com/1249348","tags":["report"]},{"url":"https://bugzilla.suse.com/1249367","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9086","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520675-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-5399","title":"WebSocket endless loop","description":"Due to a mistake in libcurl's WebSocket code, a malicious server can send a\nparticularly crafted packet which makes libcurl get trapped in an endless\nbusy-loop.\n\nThere is no other way for the application to escape or exit this loop other\nthan killing the thread/process.\n\nThis might be used to DoS libcurl-using application.","status":"published","published":"2025-06-07T07:49:09.37Z","modified":"2025-06-09T13:20:29.843Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:32:30.302289Z"}],"euvd":[{"id":"EUVD-2025-17371","description":"Due to a mistake in libcurl's WebSocket code, a malicious server can send a\nparticularly crafted packet which makes libcurl get trapped in an endless\nbusy-loop.\n\nThere is no other way for the application to escape or exit this loop other\nthan killing the thread/process.\n\nThis might be used to DoS libcurl-using application.","status":"published","published":"2025-06-07T07:49:09Z","modified":"2025-06-09T13:20:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:28.158705Z"}],"ghsa":[{"id":"GHSA-8h93-38hx-vv92","title":"Due to a mistake in libcurl's WebSocket code, a malicious server can send a\nparticularly crafted...","description":"Due to a mistake in libcurl's WebSocket code, a malicious server can send a\nparticularly crafted packet which makes libcurl get trapped in an endless\nbusy-loop.\n\nThere is no other way for the application to escape or exit this loop other\nthan killing the thread/process.\n\nThis might be used to DoS libcurl-using application.","status":"published","published":"2025-06-07T09:30:18Z","modified":"2025-07-30T21:32:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:03:09.000825Z"}],"nvd":[{"id":"CVE-2025-5399","description":"Due to a mistake in libcurl's WebSocket code, a malicious server can send a\nparticularly crafted packet which makes libcurl get trapped in an endless\nbusy-loop.\n\nThere is no other way for the application to escape or exit this loop other\nthan killing the thread/process.\n\nThis might be used to DoS libcurl-using application.","status":"published","published":"2025-06-07T08:15:20.687Z","modified":"2026-06-17T09:47:50.807Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:11:11.4244Z"}],"osv":[{"id":"ALPINE-CVE-2025-5399","description":"Due to a mistake in libcurl's WebSocket code, a malicious server can send a\nparticularly crafted packet which makes libcurl get trapped in an endless\nbusy-loop.\n\nThere is no other way for the application to escape or exit this loop other\nthan killing the thread/process.\n\nThis might be used to DoS libcurl-using application.","status":"published","published":"2025-06-07T08:15:20.687Z","modified":"2026-08-27T22:18:02.990922023Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2025-5399","status":"published","published":"2025-06-05T07:39:40.947588Z","modified":"2026-01-26T09:40:32.236804Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-5399","title":"WebSocket endless loop","description":"Due to a mistake in libcurl's WebSocket code, a malicious server can send a\nparticularly crafted packet which makes libcurl get trapped in an endless\nbusy-loop.\n\nThere is no other way for the application to escape or exit this loop other\nthan killing the thread/process.\n\nThis might be used to DoS libcurl-using application.","status":"published","published":"2025-06-07T07:49:09.37Z","modified":"2026-10-28T02:30:21.104053946Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:50.863921Z"},{"id":"DEBIAN-CVE-2025-5399","description":"Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.  There is no other way for the application to escape or exit this loop other than killing the thread/process.  This might be used to DoS libcurl-using application.","status":"published","published":"2025-06-07T08:15:20.687Z","modified":"2026-09-01T20:05:53.884199886Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"JLSEC-2026-434","title":"Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted...","description":"Due to a mistake in libcurl's WebSocket code, a malicious server can send a\nparticularly crafted packet which makes libcurl get trapped in an endless\nbusy-loop.\n\nThere is no other way for the application to escape or exit this loop other\nthan killing the thread/process.\n\nThis might be used to DoS libcurl-using application.","status":"published","published":"2026-05-04T13:12:06.605Z","modified":"2026-07-18T00:02:00.883336751Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"RLSA-2025:15699","title":"Moderate: mysql-selinux and mysql8.4 security update","description":"MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.\n\nSecurity Fix(es):\n\n* openssl: Timing side-channel in ECDSA signature computation (CVE-2024-13176)\n\n* mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722)\n\n* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30688)\n\n* mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) (CVE-2025-30699)\n\n* mysql: UDF unspecified vulnerability (CPU Apr 2025) (CVE-2025-30721)\n\n* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30682)\n\n* mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30683)\n\n* mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30715)\n\n* mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21574)\n\n* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21585)\n\n* mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21588)\n\n* mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30681)\n\n* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-21577)\n\n* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30687)\n\n* mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21580)\n\n* mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30696)\n\n* mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30705)\n\n* mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21575)\n\n* mysql: Options unspecified vulnerability (CPU Apr 2025) (CVE-2025-21579)\n\n* mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30685)\n\n* mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30704)\n\n* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21581)\n\n* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30689)\n\n* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30695)\n\n* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30703)\n\n* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693)\n\n* mysql: DDL unspecified vulnerability (CPU Apr 2025) (CVE-2025-21584)\n\n* mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30684)\n\n* curl: libcurl: WebSocket endless loop (CVE-2025-5399)\n\n* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50092)\n\n* mysql: mysqldump unspecified vulnerability (CPU Jul 2025) (CVE-2025-50081)\n\n* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50079)\n\n* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50077)\n\n* mysql: DML unspecified vulnerability (CPU Jul 2025) (CVE-2025-50078)\n\n* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50091)\n\n* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50101)\n\n* mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50093)\n\n* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50099)\n\n* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50085)\n\n* mysql: Components Services unspecified vulnerability (CPU Jul 2025) (CVE-2025-50086)\n\n* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50082)\n\n* mysql: Encryption unspecified vulnerability (CPU Jul 2025) (CVE-2025-50097)\n\n* mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50104)\n\n* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50087)\n\n* mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) (CVE-2025-50080)\n\n* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50088)\n\n* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50083)\n\n* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50084)\n\n* mysql: Thread Pooling unspecified vulnerability (CPU Jul 2025) (CVE-2025-50100)\n\n* mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50094)\n\n* mysql: Optimizer  unspecified vulnerability (CPU Jul 2025) (CVE-2025-50098)\n\n* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50096)\n\n* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50102)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-08T17:12:49.834505Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"ALSA-2025:15699","title":"Moderate: mysql-selinux and mysql8.4 security update","description":"MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.  \n\nSecurity Fix(es):  \n\n  * openssl: Timing side-channel in ECDSA signature computation (CVE-2024-13176)\n  * mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722)\n  * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30688)\n  * mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) (CVE-2025-30699)\n  * mysql: UDF unspecified vulnerability (CPU Apr 2025) (CVE-2025-30721)\n  * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30682)\n  * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30683)\n  * mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30715)\n  * mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21574)\n  * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21585)\n  * mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21588)\n  * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30681)\n  * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-21577)\n  * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30687)\n  * mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21580)\n  * mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30696)\n  * mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30705)\n  * mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21575)\n  * mysql: Options unspecified vulnerability (CPU Apr 2025) (CVE-2025-21579)\n  * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30685)\n  * mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30704)\n  * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21581)\n  * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30689)\n  * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30695)\n  * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30703)\n  * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693)\n  * mysql: DDL unspecified vulnerability (CPU Apr 2025) (CVE-2025-21584)\n  * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30684)\n  * curl: libcurl: WebSocket endless loop (CVE-2025-5399)\n  * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50092)\n  * mysql: mysqldump unspecified vulnerability (CPU Jul 2025) (CVE-2025-50081)\n  * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50079)\n  * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50077)\n  * mysql: DML unspecified vulnerability (CPU Jul 2025) (CVE-2025-50078)\n  * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50091)\n  * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50101)\n  * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50093)\n  * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50099)\n  * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50085)\n  * mysql: Components Services unspecified vulnerability (CPU Jul 2025) (CVE-2025-50086)\n  * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50082)\n  * mysql: Encryption unspecified vulnerability (CPU Jul 2025) (CVE-2025-50097)\n  * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50104)\n  * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50087)\n  * mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) (CVE-2025-50080)\n  * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50088)\n  * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50083)\n  * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50084)\n  * mysql: Thread Pooling unspecified vulnerability (CPU Jul 2025) (CVE-2025-50100)\n  * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50094)\n  * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50098)\n  * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50096)\n  * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50102)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-09-11T00:00:00Z","modified":"2026-10-29T11:30:04.934064543Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:16046","title":"Moderate: mysql:8.4 security update","description":"MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.  \n\nSecurity Fix(es):  \n\n  * openssl: Timing side-channel in ECDSA signature computation (CVE-2024-13176)\n  * mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722)\n  * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30688)\n  * mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) (CVE-2025-30699)\n  * mysql: UDF unspecified vulnerability (CPU Apr 2025) (CVE-2025-30721)\n  * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30682)\n  * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30683)\n  * mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30715)\n  * mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21574)\n  * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21585)\n  * mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21588)\n  * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30681)\n  * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-21577)\n  * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30687)\n  * mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21580)\n  * mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30696)\n  * mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30705)\n  * mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21575)\n  * mysql: Options unspecified vulnerability (CPU Apr 2025) (CVE-2025-21579)\n  * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30685)\n  * mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30704)\n  * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21581)\n  * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30689)\n  * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30695)\n  * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30703)\n  * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693)\n  * mysql: DDL unspecified vulnerability (CPU Apr 2025) (CVE-2025-21584)\n  * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30684)\n  * curl: libcurl: WebSocket endless loop (CVE-2025-5399)\n  * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50092)\n  * mysql: mysqldump unspecified vulnerability (CPU Jul 2025) (CVE-2025-50081)\n  * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50079)\n  * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50077)\n  * mysql: DML unspecified vulnerability (CPU Jul 2025) (CVE-2025-50078)\n  * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50091)\n  * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50101)\n  * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50093)\n  * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50099)\n  * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50085)\n  * mysql: Components Services unspecified vulnerability (CPU Jul 2025) (CVE-2025-50086)\n  * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50082)\n  * mysql: Encryption unspecified vulnerability (CPU Jul 2025) (CVE-2025-50097)\n  * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50104)\n  * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50087)\n  * mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) (CVE-2025-50080)\n  * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50088)\n  * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50083)\n  * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50084)\n  * mysql: Thread Pooling unspecified vulnerability (CPU Jul 2025) (CVE-2025-50100)\n  * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50094)\n  * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50098)\n  * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50096)\n  * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50102)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-09-17T00:00:00Z","modified":"2026-10-29T11:32:28.250442929Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"CLSA-2025-1766409829","title":"mysql: Fix of 33 CVEs","description":"- Update to MySQL 8.0.44\n  CVE-2025-53069 CVE-2025-53042 CVE-2025-53053 CVE-2025-53062 CVE-2025-53044\n  CVE-2025-53040 CVE-2025-53054 CVE-2025-53045\n- MySQL 8.0.43\n  CVE-2025-50078 CVE-2025-50082 CVE-2025-50083 CVE-2025-50085 CVE-2025-50077\n  CVE-2025-50088 CVE-2025-50092 CVE-2025-50099 CVE-2025-50086 CVE-2025-50093\n  CVE-2025-50094 CVE-2025-50079 CVE-2025-50084 CVE-2025-50087 CVE-2025-50091\n  CVE-2025-50101 CVE-2025-50102 CVE-2025-53023 CVE-2025-50097 CVE-2025-50080\n  CVE-2025-50096 CVE-2025-5399  CVE-2025-50104 CVE-2025-50098 CVE-2025-50100","status":"published","published":"2025-12-22T13:23:52Z","modified":"2026-10-21T10:46:30.300075214Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CURL-CVE-2025-5399","title":"WebSocket endless loop","description":"Due to a mistake in libcurl's WebSocket code, a malicious server can send a\nparticularly crafted packet which makes libcurl get trapped in an endless\nbusy-loop.\n\nThere is no other way for the application to escape or exit this loop other\nthan killing the thread/process.\n\nThis might be used to DoS libcurl-using application.","status":"published","published":"2025-06-04T08:00:00Z","modified":"2026-10-25T01:04:36.094097253Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"openSUSE-SU-2025:15213-1","title":"curl-8.14.1-4.1 on GA media","description":"These are all security issues fixed in the curl-8.14.1-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:29.945737Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2025:03198-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nUpdate to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).    \n    \nSecurity issues fixed:\n\n- CVE-2025-0665: eventfd double close can cause libcurl to act unreliably (bsc#1236589).\n- CVE-2025-4947: QUIC certificate check is skipped with wolfSSL allows for MITM attacks (bsc#1243397).\n- CVE-2025-5025: no QUIC certificate pinning with wolfSSL can lead to connections to impostor servers that are not\n  easily noticed (bsc#1243706).\n- CVE-2025-5399: bug in websocket code can cause libcurl to get trapped in an endless busy-loop when processing\n  specially crafted packets (bsc#1243933).\n- CVE-2024-6874: punycode conversions to/from IDN can leak stack content when libcurl is built to use the macidn IDN\n  backend (bsc#1228260).\n- CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer\n  (bsc#1249191).\n- CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).\n\nOther issues fixed:\n    \n- Fix wrong return code when --retry is used (bsc#1249367).\n  * tool_operate: fix return code when --retry is used but not triggered [b42776b]\n    \n- Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).\n  * tool_getparam: fix --ftp-pasv [5f805ee]\n\n- Fixed with version 8.14.1:\n  * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.\n  * websocket: add option to disable auto-pong reply.\n  * huge number of bugfixes.\n\n  Please see https://curl.se/ch/ for full changelogs.\n","status":"published","published":"2025-09-12T12:15:10Z","modified":"2026-03-23T04:50:28.709496Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:20675-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2025-5399: libcurl can possibly get trapped in an endless busy-loop when processing specially crafted packets (bsc#1243933).\n- CVE-2025-5025: No QUIC certificate pinning with wolfSSL (bsc#1243706).\n- CVE-2025-4947: QUIC certificate check skip with wolfSSL (bsc#1243397).\n\nOther bugfixes:\n\n- Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).\n","status":"published","published":"2025-09-09T10:21:16Z","modified":"2026-03-23T04:47:18.016584Z","updated_at":"2026-11-02T15:53:59.92114Z"}]}}