Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.
There is no other way for the application to escape or exit this loop other than killing the thread/process.
This might be used to DoS libcurl-using application.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mysql-libsUpgrade rapidjson-docUpgrade mysql-commonUpgrade mecab-ipadic-EUCJPUpgrade rapidjson-develUpgrade mysql-develUpgrade mysql-serverUpgrade mysqlUpgrade mysql-test-dataUpgrade mysql-errmsgUpgrade mecabUpgrade mecab-ipadicUpgrade mysql-testUpgrade mecab-devel | Sep 19, 2025 | Sep 17, 2025 |
| Alpine Linux | — | Upgrade curl | Aug 8, 2025 | Jun 7, 2025 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 7, 2025 |
| Debian | — | Upgrade curl | Jul 23, 2026 | Jul 23, 2026 |
| Oracle Mysql | — | Upgrade to MySQL version 8.0.43Upgrade to MySQL version 8.4.6Upgrade to MySQL version 9.4.0 | Jul 16, 2025 | Jun 7, 2025 |
| Oracle_linux | — | Upgrade mysql8.4-errmsgUpgrade mysql8.4-test-dataUpgrade rapidjson-docUpgrade mecab-develUpgrade mysql-libsUpgrade mysql-serverUpgrade mecab-ipadic-EUCJPUpgrade mysql8.4-libsUpgrade mysql-develUpgrade rapidjson-develUpgrade mysql8.4-develUpgrade mysql-commonUpgrade mysql-errmsgUpgrade mecab-ipadicUpgrade mysqlUpgrade mysql8.4-commonUpgrade mysql-selinuxUpgrade mysql8.4-testUpgrade mysql-testUpgrade mysql-test-dataUpgrade mecabUpgrade mysql8.4-serverUpgrade mysql8.4 | Sep 15, 2025 | Jun 7, 2025 |
| Redhat_linux | — | Upgrade mysql-debuginfo-8.4.6Upgrade mysql-test-8.4.6Upgrade mecab-debugsource-0.996Upgrade mysql-libs-8.4.6Upgrade mecab-0.996Upgrade mysql-server-8.4.6Upgrade mysql-libs-debuginfo-8.4.6Upgrade mecab-devel-0.996Upgrade mysql-server-debuginfo-8.4.6Upgrade mysql-errmsg-8.4.6Upgrade mysql-test-debuginfo-8.4.6Upgrade mecab-debuginfo-0.996Upgrade mysql-common-8.4.6Upgrade mysql-8.4.6Upgrade rapidjson-devel-1.1.0Upgrade mecab-ipadic-EUCJP-2.7.0.20070801Upgrade rapidjson-doc-1.1.0Upgrade mysql-test-data-8.4.6Upgrade mysql-devel-8.4.6Upgrade mysql-debugsource-8.4.6Upgrade mecab-ipadic-2.7.0.20070801Upgrade mysql-devel-debuginfo-8.4.6 | Jul 17, 2025 | Jun 7, 2025 |
| Rocky_linux | — | Upgrade mysql8.4-serverUpgrade mysql8.4-debugsourceUpgrade mysql8.4-debuginfoUpgrade mysql8.4-libsUpgrade mysql8.4-server-debuginfoUpgrade mysql8.4-test-debuginfoUpgrade mysql8.4-testUpgrade mysql8.4-libs-debuginfoUpgrade mysql8.4-devel-debuginfoUpgrade mysql8.4-develUpgrade mysql8.4 | Feb 5, 2026 | Oct 3, 2025 |
| Suse | — | Upgrade libcurl-develUpgrade libcurl4Upgrade libcurl4-32bitUpgrade curl-zsh-completionUpgrade libcurl-devel-docUpgrade curlUpgrade libcurl-mini4Upgrade libcurl-devel-32bit | Sep 15, 2025 | Sep 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub