CVE-2025-10148

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10148", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "state": "PUBLISHED", "assignerShortName": "curl", "dateReserved": "2025-09-09T03:45:41.908Z", "datePublished": "2025-09-12T05:10:37.469Z", "dateUpdated": "2026-09-15T06:02:23.283Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-15T06:02:23.283Z"}, "title": "predictable WebSocket mask", "descriptions": [{"lang": "en", "value": "curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy."}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"version": "8.11.0", "status": "affected", "versionType": "semver", "lessThan": "8.14.2"}, {"version": "8.15.0", "status": "affected", "versionType": "semver", "lessThan": "8.16.0"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"version": "d78e129d50b2d190f1c1bde2ad1f62f02f152db0", "status": "affected", "versionType": "git", "lessThan": "84db7a9eae8468c0445b15aa806fa7fa806fa0f2"}], "defaultStatus": "unaffected", "repo": "https://github.com/curl/curl.git"}, {"vendor": "curl", "product": "curl", "versions": [{"version": "8.15.0", "status": "affected"}, {"version": "8.14.1", "status": "affected"}, {"version": "8.14.0", "status": "affected"}, {"version": "8.13.0", "status": "affected"}, {"version": "8.12.1", "status": "affected"}, {"version": "8.12.0", "status": "affected"}, {"version": "8.11.1", "status": "affected"}, {"version": "8.11.0", "status": "affected"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2025-10148.json"}, {"url": "https://curl.se/docs/CVE-2025-10148.html"}, {"url": "https://hackerone.com/reports/3330839"}], "x_osv": {"schema_version": "1.5.0", "id": "CURL-CVE-2025-10148", "aliases": ["CVE-2025-10148"], "summary": "predictable WebSocket mask", "modified": "2026-09-07T10:34:51.00Z", "database_specific": {"package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2025-10148.json", "www": "https://curl.se/docs/CVE-2025-10148.html", "issue": "https://hackerone.com/reports/3330839", "CWE": {"id": "CWE-340", "desc": "Generation of Predictable Numbers or Identifiers"}, "award": {"amount": "505", "currency": "USD"}, "last_affected": "8.15.0", "severity": "Low"}, "published": "2025-09-10T08:00:00.00Z", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "8.11.0"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.0"}]}, {"type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [{"introduced": "d78e129d50b2d190f1c1bde2ad1f62f02f152db0"}, {"fixed": "84db7a9eae8468c0445b15aa806fa7fa806fa0f2"}]}], "versions": ["8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0"]}], "credits": [{"name": "Calvin Ruocco (Vector Informatik GmbH)", "type": "finder"}, {"name": "Daniel Stenberg", "type": "remediation developer"}], "details": "curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy."}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Generation of Predictable Numbers or Identifiers", "cweId": "CWE-340", "type": "CWE"}]}], "credits": [{"lang": "en", "value": "Calvin Ruocco (Vector Informatik GmbH)", "type": "finder"}, {"lang": "en", "value": "Daniel Stenberg", "type": "remediation developer"}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-09-12T17:16:46.486840Z", "id": "CVE-2025-10148", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-12T17:17:12.815Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/09/10/2"}, {"url": "http://www.openwall.com/lists/oss-security/2025/09/10/3"}, {"url": "http://www.openwall.com/lists/oss-security/2025/09/10/4"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-18T20:05:32.822Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/09/10/2"}, {"url": "http://www.openwall.com/lists/oss-security/2025/09/10/3"}, {"url": "http://www.openwall.com/lists/oss-security/2025/09/10/4"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-18T20:05:32.822Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-10148", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-12T17:16:46.486840Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-12T17:17:07.462Z"}}], "cna": {"title": "predictable WebSocket mask", "x_osv": {"id": "CURL-CVE-2025-10148", "aliases": ["CVE-2025-10148"], "credits": [{"name": "Calvin Ruocco (Vector Informatik GmbH)", "type": "finder"}, {"name": "Daniel Stenberg", "type": "remediation developer"}], "details": "curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy.", "summary": "predictable WebSocket mask", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "8.11.0"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.0"}]}, {"repo": "https://github.com/curl/curl.git", "type": "GIT", "events": [{"introduced": "d78e129d50b2d190f1c1bde2ad1f62f02f152db0"}, {"fixed": "84db7a9eae8468c0445b15aa806fa7fa806fa0f2"}]}], "versions": ["8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0"]}], "modified": "2026-09-07T10:34:51.00Z", "published": "2025-09-10T08:00:00.00Z", "schema_version": "1.5.0", "database_specific": {"CWE": {"id": "CWE-340", "desc": "Generation of Predictable Numbers or Identifiers"}, "URL": "https://curl.se/docs/CVE-2025-10148.json", "www": "https://curl.se/docs/CVE-2025-10148.html", "award": {"amount": "505", "currency": "USD"}, "issue": "https://hackerone.com/reports/3330839", "affects": "both", "package": "curl", "severity": "Low", "last_affected": "8.15.0"}}, "credits": [{"lang": "en", "type": "finder", "value": "Calvin Ruocco (Vector Informatik GmbH)"}, {"lang": "en", "type": "remediation developer", "value": "Daniel Stenberg"}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.11.0", "lessThan": "8.14.2", "versionType": "semver"}, {"status": "affected", "version": "8.15.0", "lessThan": "8.16.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"repo": "https://github.com/curl/curl.git", "vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "d78e129d50b2d190f1c1bde2ad1f62f02f152db0", "lessThan": "84db7a9eae8468c0445b15aa806fa7fa806fa0f2", "versionType": "git"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.15.0"}, {"status": "affected", "version": "8.14.1"}, {"status": "affected", "version": "8.14.0"}, {"status": "affected", "version": "8.13.0"}, {"status": "affected", "version": "8.12.1"}, {"status": "affected", "version": "8.12.0"}, {"status": "affected", "version": "8.11.1"}, {"status": "affected", "version": "8.11.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2025-10148.json"}, {"url": "https://curl.se/docs/CVE-2025-10148.html"}, {"url": "https://hackerone.com/reports/3330839"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-340", "description": "Generation of Predictable Numbers or Identifiers"}]}], "providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-15T06:02:23.283Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10148", "state": "PUBLISHED", "dateUpdated": "2026-09-15T06:02:23.283Z", "dateReserved": "2025-09-09T03:45:41.908Z", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "datePublished": "2025-09-12T05:10:37.469Z", "assignerShortName": "curl"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"lessThan": "8.14.2", "status": "affected", "version": "8.11.0", "versionType": "semver"}, {"lessThan": "8.16.0", "status": "affected", "version": "8.15.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "curl", "repo": "https://github.com/curl/curl.git", "vendor": "curl", "versions": [{"lessThan": "84db7a9eae8468c0445b15aa806fa7fa806fa0f2", "status": "affected", "version": "d78e129d50b2d190f1c1bde2ad1f62f02f152db0", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"status": "affected", "version": "8.15.0"}, {"status": "affected", "version": "8.14.1"}, {"status": "affected", "version": "8.14.0"}, {"status": "affected", "version": "8.13.0"}, {"status": "affected", "version": "8.12.1"}, {"status": "affected", "version": "8.12.0"}, {"status": "affected", "version": "8.11.1"}, {"status": "affected", "version": "8.11.0"}]}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*", "matchCriteriaId": "A2D88104-00EB-4B8B-88D4-9FCCEF41FA6B", "versionEndExcluding": "8.16.0", "versionStartIncluding": "8.11.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy."}, {"lang": "es", "value": "El c\u00f3digo websocket de curl no actualiz\u00f3 el patr\u00f3n de m\u00e1scara de 32 bits para cada nuevo frame saliente como indica la especificaci\u00f3n. En su lugar, utiliz\u00f3 una m\u00e1scara fija que persisti\u00f3 y se us\u00f3 durante toda la conexi\u00f3n.\n\nUn patr\u00f3n de m\u00e1scara predecible permite que un servidor malicioso induzca tr\u00e1fico entre las dos partes comunicantes que podr\u00eda ser interpretado por un proxy involucrado (configurado o transparente) como tr\u00e1fico HTTP genuino, real, con contenido y as\u00ed envenenar su cach\u00e9. Ese contenido envenenado en cach\u00e9 podr\u00eda entonces ser servido a todos los usuarios de ese proxy."}], "id": "CVE-2025-10148", "lastModified": "2026-10-19T17:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10148", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-12T17:16:46.486840Z", "version": "2.0.3"}}]}, "published": "2025-09-12T06:15:40.020", "references": [{"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Patch", "Vendor Advisory"], "url": "https://curl.se/docs/CVE-2025-10148.html"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Vendor Advisory"], "url": "https://curl.se/docs/CVE-2025-10148.json"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://hackerone.com/reports/3330839"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2025/09/10/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2025/09/10/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2025/09/10/4"}], "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-340"}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "curl: predictable WebSocket mask", "id": "2394749", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2394749"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-340", "details": ["A flaw was found in curl. The use of a predictable WebSocket mask pattern allows a malicious server to induce traffic that an intermediary proxy (whether configured or transparent) will misinterpret as a standard HTTP request. This confusion leads to a cache poisoning attack, where the proxy stores the server's malicious content and serves it to all users of that proxy."], "name": "CVE-2025-10148", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_core_services:1", "fix_state": "Fix deferred", "package_name": "curl", "product_name": "Red Hat JBoss Core Services"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3:", "fix_state": "Not affected", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:trusted_profile_analyzer:2", "fix_state": "Not affected", "package_name": "rhtpa/rhtpa-trustification-service-rhel9", "product_name": "Red Hat Trusted Profile Analyzer"}], "public_date": "2025-09-12T05:10:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-10148\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-10148\nhttps://curl.se/docs/CVE-2025-10148.html\nhttps://curl.se/docs/CVE-2025-10148.json\nhttps://hackerone.com/reports/3330839"], "threat_severity": "Low"}

{"created": "2025-09-15T10:43:57.901003+00:00", "updated": "2025-09-15T10:43:57.901078+00:00", "vendors": ["curl", "curl$PRODUCT$curl"]}