Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.
There is no other way for the application to escape or exit this loop other than killing the thread/process.
This might be used to DoS libcurl-using application.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mysql-libsUpgrade rapidjson-docUpgrade mysql-commonUpgrade mecab-ipadic-EUCJPUpgrade rapidjson-develUpgrade mysql-develUpgrade mysql-serverUpgrade mysqlUpgrade mysql-test-dataUpgrade mysql-errmsgUpgrade mecabUpgrade mecab-ipadicUpgrade mysql-testUpgrade mecab-devel | Sep 19, 2025 | Sep 17, 2025 |
| Alpine Linux | — | Upgrade curl | Aug 8, 2025 | Jun 7, 2025 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 7, 2025 |
| Debian | — | Upgrade curl | Jul 23, 2026 | Jul 23, 2026 |
| Oracle Mysql | — | Upgrade to MySQL version 8.0.43Upgrade to MySQL version 8.4.6Upgrade to MySQL version 9.4.0 | Jul 16, 2025 | Jun 7, 2025 |
| Oracle_linux | — | Upgrade mysql8.4-errmsgUpgrade mysql8.4-test-dataUpgrade rapidjson-docUpgrade mecab-develUpgrade mysql-libsUpgrade mysql-serverUpgrade mecab-ipadic-EUCJPUpgrade mysql8.4-libsUpgrade mysql-develUpgrade rapidjson-develUpgrade mysql8.4-develUpgrade mysql-commonUpgrade mysql-errmsgUpgrade mecab-ipadicUpgrade mysqlUpgrade mysql8.4-commonUpgrade mysql-selinuxUpgrade mysql8.4-testUpgrade mysql-testUpgrade mysql-test-dataUpgrade mecabUpgrade mysql8.4-serverUpgrade mysql8.4 | Sep 15, 2025 | Jun 7, 2025 |
| Redhat_linux | — | Upgrade mysql-debuginfo-8.4.6Upgrade mysql-test-8.4.6Upgrade mecab-debugsource-0.996Upgrade mysql-libs-8.4.6Upgrade mecab-0.996Upgrade mysql-server-8.4.6Upgrade mysql-libs-debuginfo-8.4.6Upgrade mecab-devel-0.996Upgrade mysql-server-debuginfo-8.4.6Upgrade mysql-errmsg-8.4.6Upgrade mysql-test-debuginfo-8.4.6Upgrade mecab-debuginfo-0.996Upgrade mysql-common-8.4.6Upgrade mysql-8.4.6Upgrade rapidjson-devel-1.1.0Upgrade mecab-ipadic-EUCJP-2.7.0.20070801Upgrade rapidjson-doc-1.1.0Upgrade mysql-test-data-8.4.6Upgrade mysql-devel-8.4.6Upgrade mysql-debugsource-8.4.6Upgrade mecab-ipadic-2.7.0.20070801Upgrade mysql-devel-debuginfo-8.4.6 | Jul 17, 2025 | Jun 7, 2025 |
| Rocky_linux | — | Upgrade mysql8.4-serverUpgrade mysql8.4-debugsourceUpgrade mysql8.4-debuginfoUpgrade mysql8.4-libsUpgrade mysql8.4-server-debuginfoUpgrade mysql8.4-test-debuginfoUpgrade mysql8.4-testUpgrade mysql8.4-libs-debuginfoUpgrade mysql8.4-devel-debuginfoUpgrade mysql8.4-develUpgrade mysql8.4 | Feb 5, 2026 | Oct 3, 2025 |
| Suse | — | Upgrade libcurl-develUpgrade libcurl4Upgrade libcurl4-32bitUpgrade curl-zsh-completionUpgrade libcurl-devel-docUpgrade curlUpgrade libcurl-mini4Upgrade libcurl-devel-32bit | Sep 15, 2025 | Sep 12, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub