CVE-2025-10148
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
12/09/2025
Last modified:
18/11/2025
Description
curl&#39;s websocket code did not update the 32 bit mask pattern for each new<br />
outgoing frame as the specification says. Instead it used a fixed mask that<br />
persisted and was used throughout the entire connection.<br />
<br />
A predictable mask pattern allows for a malicious server to induce traffic<br />
between the two communicating parties that could be interpreted by an involved<br />
proxy (configured or transparent) as genuine, real, HTTP traffic with content<br />
and thereby poison its cache. That cached poisoned content could then be<br />
served to all users of that proxy.
Impact
Base Score 3.x
5.30
Severity 3.x
MEDIUM