Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.
There is no other way for the application to escape or exit this loop other than killing the thread/process.
This might be used to DoS libcurl-using application.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mysql-libsUpgrade mysql-develUpgrade rapidjson-develUpgrade mysql-serverUpgrade mysql-commonUpgrade mecab-ipadic-EUCJPUpgrade rapidjson-docUpgrade mysql-testUpgrade mysql-test-dataUpgrade mysql-errmsgUpgrade mysqlUpgrade mecabUpgrade mecab-ipadicUpgrade mecab-devel | Sep 19, 2025 | Sep 17, 2025 |
| Alpine Linux | — | Upgrade curl | Aug 8, 2025 | Jun 7, 2025 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 7, 2025 |
| Debian | — | Upgrade curl | Jul 23, 2026 | Jul 23, 2026 |
| Oracle Mysql | — | Upgrade to MySQL version 9.4.0Upgrade to MySQL version 8.4.6Upgrade to MySQL version 8.0.43 | Jul 16, 2025 | Jun 7, 2025 |
| Oracle_linux | — | Upgrade mysql-test-dataUpgrade mysql-errmsgUpgrade mysql-testUpgrade mysql8.4-serverUpgrade mysql8.4Upgrade mecab-ipadicUpgrade mysqlUpgrade mysql8.4-testUpgrade mecabUpgrade mysql8.4-commonUpgrade mysql-selinuxUpgrade mecab-develUpgrade mysql8.4-libsUpgrade mysql-serverUpgrade rapidjson-develUpgrade mysql8.4-test-dataUpgrade rapidjson-docUpgrade mecab-ipadic-EUCJPUpgrade mysql-develUpgrade mysql-commonUpgrade mysql8.4-errmsgUpgrade mysql8.4-develUpgrade mysql-libs | Sep 15, 2025 | Jun 7, 2025 |
| Redhat_linux | — | Upgrade mecab-debugsource-0.996Upgrade mecab-devel-0.996Upgrade mysql-server-debuginfo-8.4.6Upgrade mecab-0.996Upgrade mysql-errmsg-8.4.6Upgrade mysql-libs-debuginfo-8.4.6Upgrade mysql-debuginfo-8.4.6Upgrade mysql-libs-8.4.6Upgrade mysql-test-8.4.6Upgrade mysql-server-8.4.6Upgrade mysql-devel-debuginfo-8.4.6Upgrade rapidjson-devel-1.1.0Upgrade mysql-test-data-8.4.6Upgrade mecab-ipadic-EUCJP-2.7.0.20070801Upgrade mysql-8.4.6Upgrade rapidjson-doc-1.1.0Upgrade mecab-ipadic-2.7.0.20070801Upgrade mysql-debugsource-8.4.6Upgrade mysql-devel-8.4.6Upgrade mysql-test-debuginfo-8.4.6Upgrade mysql-common-8.4.6Upgrade mecab-debuginfo-0.996 | Jul 17, 2025 | Jun 7, 2025 |
| Rocky_linux | — | Upgrade mysql8.4-devel-debuginfoUpgrade mysql8.4-libs-debuginfoUpgrade mysql8.4-develUpgrade mysql8.4Upgrade mysql8.4-test-debuginfoUpgrade mysql8.4-server-debuginfoUpgrade mysql8.4-testUpgrade mysql8.4-debuginfoUpgrade mysql8.4-libsUpgrade mysql8.4-debugsourceUpgrade mysql8.4-server | Feb 5, 2026 | Oct 3, 2025 |
| Suse | — | Upgrade libcurl-develUpgrade libcurl4Upgrade libcurl-devel-32bitUpgrade libcurl-devel-docUpgrade libcurl4-32bitUpgrade curl-zsh-completionUpgrade libcurl-mini4Upgrade curl | Sep 15, 2025 | Sep 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub