Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.
There is no other way for the application to escape or exit this loop other than killing the thread/process.
This might be used to DoS libcurl-using application.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rapidjson-docUpgrade mecab-ipadic-EUCJPUpgrade mysql-libsUpgrade mysql-commonUpgrade mysql-serverUpgrade rapidjson-develUpgrade mysql-develUpgrade mysql-test-dataUpgrade mecab-develUpgrade mysql-testUpgrade mecab-ipadicUpgrade mysqlUpgrade mysql-errmsgUpgrade mecab | Sep 19, 2025 | Sep 17, 2025 |
| Alpine Linux | — | Upgrade curl | Aug 8, 2025 | Jun 7, 2025 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 7, 2025 |
| Debian | — | Upgrade curl | Jul 23, 2026 | Jul 23, 2026 |
| Oracle Mysql | — | Upgrade to MySQL version 8.0.43Upgrade to MySQL version 8.4.6Upgrade to MySQL version 9.4.0 | Jul 16, 2025 | Jun 7, 2025 |
| Oracle_linux | — | Upgrade mysql8.4-commonUpgrade mysql8.4-testUpgrade mysql-selinuxUpgrade mysqlUpgrade mysql8.4Upgrade mecabUpgrade mecab-ipadicUpgrade mysql-test-dataUpgrade mysql-errmsgUpgrade mysql-testUpgrade mysql8.4-serverUpgrade rapidjson-develUpgrade mecab-ipadic-EUCJPUpgrade mysql8.4-test-dataUpgrade mysql8.4-libsUpgrade mysql-commonUpgrade rapidjson-docUpgrade mysql8.4-errmsgUpgrade mysql-serverUpgrade mysql8.4-develUpgrade mysql-develUpgrade mecab-develUpgrade mysql-libs | Sep 15, 2025 | Jun 7, 2025 |
| Redhat_linux | — | Upgrade mecab-ipadic-2.7.0.20070801Upgrade rapidjson-doc-1.1.0Upgrade mysql-debugsource-8.4.6Upgrade mysql-devel-8.4.6Upgrade mysql-test-debuginfo-8.4.6Upgrade mecab-ipadic-EUCJP-2.7.0.20070801Upgrade mysql-devel-debuginfo-8.4.6Upgrade mysql-8.4.6Upgrade mecab-debuginfo-0.996Upgrade mysql-common-8.4.6Upgrade rapidjson-devel-1.1.0Upgrade mysql-test-data-8.4.6Upgrade mysql-errmsg-8.4.6Upgrade mecab-devel-0.996Upgrade mecab-0.996Upgrade mysql-server-debuginfo-8.4.6Upgrade mysql-debuginfo-8.4.6Upgrade mysql-server-8.4.6Upgrade mysql-libs-debuginfo-8.4.6Upgrade mysql-test-8.4.6Upgrade mysql-libs-8.4.6Upgrade mecab-debugsource-0.996 | Jul 17, 2025 | Jun 7, 2025 |
| Rocky_linux | — | Upgrade mysql8.4-server-debuginfoUpgrade mysql8.4-develUpgrade mysql8.4-testUpgrade mysql8.4Upgrade mysql8.4-test-debuginfoUpgrade mysql8.4-libs-debuginfoUpgrade mysql8.4-devel-debuginfoUpgrade mysql8.4-libsUpgrade mysql8.4-serverUpgrade mysql8.4-debugsourceUpgrade mysql8.4-debuginfo | Feb 5, 2026 | Oct 3, 2025 |
| Suse | — | Upgrade libcurl-devel-32bitUpgrade libcurl4-32bitUpgrade curlUpgrade curl-zsh-completionUpgrade libcurl-devel-docUpgrade libcurl-mini4Upgrade libcurl-develUpgrade libcurl4 | Sep 15, 2025 | Sep 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub