Docs Overview
Project
Bug Bounty Bug Report Code of conduct Dependencies Donate FAQ Features Governance History Install Known Bugs Logo TODO website Info
Protocols
CA Extract HTTP cookies HTTP/3 MQTT SSL certs SSL libs compared URL syntax WebSocket
Releases
Changelog curl CVEs Release Table Version Numbering Vulnerabilities
Tool
Comparison Table curl man page HTTP Scripting mk-ca-bundle Tutorial When options were added
Who and Why
Companies Copyright Sponsors Thanks The name
curl / Docs / curl CVEs / predictable WebSocket mask
Related:
Audits
Bug Bounty
Changelog
curl CVEs
JSON metadata
Original report
Vulnerability Disclosure
Vulnerabilities Table
Awarded 505 USD

CVE-2025-10148

predictable WebSocket mask

Project curl Security Advisory, September 10 2025 - Permalink

VULNERABILITY

curl's websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection.

A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.

INFO

This exact scenario is warned about in the security section of the WebSocket RFC 6455 and is the very reason the mask should be updated for every outgoing frame.

For this bug to become a real-life problem, the libcurl-using application must be communicating through such a (defective) proxy that confuses a WebSocket communication for HTTP traffic. Further, to trigger the problem it requires the traffic to be done using clear text HTTP / WebSocket (ws://) and not over TLS (wss://).

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2025-10148 to this issue.

CWE-340: Generation of Predictable Numbers or Identifiers

Severity: Low

AFFECTED VERSIONS

WebSocket was considered experimental before 8.11.0 and therefore we do not consider earlier versions vulnerable.

libcurl is used by many applications, but not always advertised as such!

This bug is not considered a C mistake. It is not likely to have been avoided had we not been using C.

This flaw also affects the curl command line tool.

SOLUTION

Starting in curl 8.16.0, this mistake is fixed.

RECOMMENDATIONS

A - Upgrade curl to version 8.16.0

B - Apply the patch to your local version

C - Avoid using ws://

TIMELINE

This issue was reported to the curl project on September 8, 2025. We contacted distros@openwall on September 9, 2025.

curl 8.16.0 was released on September 10 2025 around 06:00 UTC, coordinated with the publication of this advisory.

The curl security team is not aware of any active exploits using this vulnerability.

CREDITS

Thanks a lot!