vulnerability

Amazon Linux 2023: CVE-2025-10148: Medium priority package update for curl

Severity
6
CVSS
(AV:N/AC:M/Au:N/C:P/I:P/A:N)
Published
Sep 12, 2025
Added
Jan 12, 2026
Modified
Jan 12, 2026

Description

A flaw was found in curl. The use of a predictable WebSocket mask pattern allows a malicious server to induce traffic that an intermediary proxy (whether configured or transparent) will misinterpret as a standard HTTP request. This confusion leads to a cache poisoning attack, where the proxy stores the server's malicious content and serves it to all users of that proxy.

Solutions

amazon-linux-2023-upgrade-curlamazon-linux-2023-upgrade-curl-debuginfoamazon-linux-2023-upgrade-curl-debugsourceamazon-linux-2023-upgrade-curl-minimalamazon-linux-2023-upgrade-curl-minimal-debuginfoamazon-linux-2023-upgrade-libcurlamazon-linux-2023-upgrade-libcurl-debuginfoamazon-linux-2023-upgrade-libcurl-develamazon-linux-2023-upgrade-libcurl-minimalamazon-linux-2023-upgrade-libcurl-minimal-debuginfo
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.