Description (CNA)
Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS libcurl-using application.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| curl / curl | affected 8.14.0 through 8.14.0; affected 8.13.0 through 8.13.0 |
CWE
No CWE identifiers supplied.
References
- https://curl.se/docs/CVE-2025-5399.json
- https://curl.se/docs/CVE-2025-5399.html
- https://hackerone.com/reports/3168039
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.