Curl WebSocket Mask Not Updated per Frame, Allowing Cache Poisoning
CVE-2025-10148 Published on September 12, 2025

predictable WebSocket mask
curl's websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.

NVD

Vulnerability Analysis

CVE-2025-10148 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
NONE
Availability Impact:
NONE

Products Associated with CVE-2025-10148

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2025-10148 are published in these products:

Haxx Curl
 
Oracle
 
Canonical Ubuntu Linux
 

Affected Versions

curl:

Exploit Probability

EPSS
0.10%
Percentile
28.05%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.