Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.
There is no other way for the application to escape or exit this loop other than killing the thread/process.
This might be used to DoS libcurl-using application.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mecabUpgrade mecab-develUpgrade mysql-errmsgUpgrade mysqlUpgrade mysql-test-dataUpgrade mysql-testUpgrade mecab-ipadicUpgrade mysql-develUpgrade rapidjson-docUpgrade mecab-ipadic-EUCJPUpgrade mysql-commonUpgrade mysql-serverUpgrade mysql-libsUpgrade rapidjson-devel | Sep 19, 2025 | Sep 17, 2025 |
| Alpine Linux | — | Upgrade curl | Aug 8, 2025 | Jun 7, 2025 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 7, 2025 |
| Debian | — | Upgrade curl | Jul 23, 2026 | Jul 23, 2026 |
| Oracle Mysql | — | Upgrade to MySQL version 8.0.43Upgrade to MySQL version 8.4.6Upgrade to MySQL version 9.4.0 | Jul 16, 2025 | Jun 7, 2025 |
| Oracle_linux | — | Upgrade rapidjson-docUpgrade mecab-ipadic-EUCJPUpgrade mecab-develUpgrade mysql-commonUpgrade mysql8.4-errmsgUpgrade mysql8.4-libsUpgrade mysql-serverUpgrade mysql-develUpgrade mysql-libsUpgrade mysql8.4-develUpgrade rapidjson-develUpgrade mysql8.4-test-dataUpgrade mysql-test-dataUpgrade mysql8.4Upgrade mysql-testUpgrade mysql8.4-testUpgrade mysql-errmsgUpgrade mysql8.4-commonUpgrade mysql-selinuxUpgrade mecab-ipadicUpgrade mysql8.4-serverUpgrade mysqlUpgrade mecab | Sep 15, 2025 | Jun 7, 2025 |
| Redhat_linux | — | Upgrade rapidjson-devel-1.1.0Upgrade mysql-debugsource-8.4.6Upgrade mysql-test-debuginfo-8.4.6Upgrade rapidjson-doc-1.1.0Upgrade mysql-common-8.4.6Upgrade mecab-debuginfo-0.996Upgrade mecab-ipadic-2.7.0.20070801Upgrade mysql-test-data-8.4.6Upgrade mecab-ipadic-EUCJP-2.7.0.20070801Upgrade mysql-devel-8.4.6Upgrade mysql-devel-debuginfo-8.4.6Upgrade mysql-8.4.6Upgrade mysql-server-debuginfo-8.4.6Upgrade mecab-debugsource-0.996Upgrade mysql-libs-8.4.6Upgrade mysql-test-8.4.6Upgrade mecab-devel-0.996Upgrade mecab-0.996Upgrade mysql-libs-debuginfo-8.4.6Upgrade mysql-debuginfo-8.4.6Upgrade mysql-server-8.4.6Upgrade mysql-errmsg-8.4.6 | Jul 17, 2025 | Jun 7, 2025 |
| Rocky_linux | — | Upgrade mysql8.4-libsUpgrade mysql8.4-debuginfoUpgrade mysql8.4-debugsourceUpgrade mysql8.4-serverUpgrade mysql8.4-test-debuginfoUpgrade mysql8.4-server-debuginfoUpgrade mysql8.4-devel-debuginfoUpgrade mysql8.4-libs-debuginfoUpgrade mysql8.4-testUpgrade mysql8.4-develUpgrade mysql8.4 | Feb 5, 2026 | Oct 3, 2025 |
| Suse | — | Upgrade curl-zsh-completionUpgrade libcurl-devel-32bitUpgrade curlUpgrade libcurl4-32bitUpgrade libcurl-devel-docUpgrade libcurl-mini4Upgrade libcurl4Upgrade libcurl-devel | Sep 15, 2025 | Sep 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub