curl CVE-2025-10148: Predictable WebSocket Mask Leading to Cache Poisoning

Critical Vulnerability Information Vulnerability ID: CURL-CVE-2025-10148 Aliases: CVE-2025-10148 Summary: Predictable WebSocket Masking Last Modified: 2025-09-10T14:23:09.00Z Affected Package: curl Impact Scope: both Related Links: - JSON: https://curl.se/docs/CVE-2025-10148.json - HTML: https://curl.se/docs/CVE-2025-10148.html - HackerOne Report: https://hackerone.com/reports/3330839 CWE: CWE-349 (Generation of Predictable Numbers or Identifiers) Reward Amount: $595 USD Last Affected Version: 8.15.0 Severity: Low Disclosure Date: 2025-09-10T08:00:00.000Z Affected Version Range: - SEMVER: 8.11.0 to 8.16.0 - GIT: d78e129d50b2d190f1c1bde2ad1f62f02f152db0 to 84db7a9eae8468c0445b15aa806fa7fa806fa0f2 Specific Affected Versions: 8.15.0, 8.14.1, 8.14.0, 8.13.0, 8.12.1, 8.12.0, 8.11.1, 8.11.0 Discoverer: Calvin Ruocco (Vector Informatik GmbH) Fix Developer: Daniel Stenberg Detailed Description: The WebSocket code in curl does not update the 32-bit mask pattern for each new outgoing frame, instead using a fixed mask that persists throughout the entire connection. This allows a malicious server to induce traffic between two communicating parties, which may be interpreted by involved proxies (configured or transparent) as legitimate HTTP traffic, thereby poisoning their cache. The poisoned content in the cache can then be served to all users of that proxy.

Goal Reached Thanks to every supporter — we hit 100%!

curl CVE-2025-10148: Predictable WebSocket Mask Leading to Cache Poisoning