Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

CVE-2025-10148

Gravedad CVSS v3.1:
MEDIA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
12/09/2025
Última modificación:
15/09/2025

Descripción

*** Pendiente de traducción *** curl&amp;#39;s websocket code did not update the 32 bit mask pattern for each new<br /> outgoing frame as the specification says. Instead it used a fixed mask that<br /> persisted and was used throughout the entire connection.<br /> <br /> A predictable mask pattern allows for a malicious server to induce traffic<br /> between the two communicating parties that could be interpreted by an involved<br /> proxy (configured or transparent) as genuine, real, HTTP traffic with content<br /> and thereby poison its cache. That cached poisoned content could then be<br /> served to all users of that proxy.