Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.
There is no other way for the application to escape or exit this loop other than killing the thread/process.
This might be used to DoS libcurl-using application.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mecab-develUpgrade mecab-ipadicUpgrade mysql-testUpgrade mysqlUpgrade mecabUpgrade mysql-test-dataUpgrade mysql-errmsgUpgrade mysql-develUpgrade rapidjson-develUpgrade rapidjson-docUpgrade mysql-commonUpgrade mecab-ipadic-EUCJPUpgrade mysql-serverUpgrade mysql-libs | Sep 19, 2025 | Sep 17, 2025 |
| Alpine Linux | — | Upgrade curl | Aug 8, 2025 | Jun 7, 2025 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 7, 2025 |
| Debian | — | Upgrade curl | Jul 23, 2026 | Jul 23, 2026 |
| Oracle Mysql | — | Upgrade to MySQL version 8.0.43Upgrade to MySQL version 8.4.6Upgrade to MySQL version 9.4.0 | Jul 16, 2025 | Jun 7, 2025 |
| Oracle_linux | — | Upgrade mysql8.4Upgrade mysql8.4-serverUpgrade mecabUpgrade mysql-errmsgUpgrade mysql-selinuxUpgrade mysql8.4-commonUpgrade mysql-testUpgrade mysql-test-dataUpgrade mysqlUpgrade mecab-ipadicUpgrade mysql8.4-testUpgrade mysql8.4-libsUpgrade mysql-commonUpgrade mecab-ipadic-EUCJPUpgrade mysql-libsUpgrade mysql8.4-test-dataUpgrade mecab-develUpgrade mysql-develUpgrade mysql8.4-develUpgrade mysql-serverUpgrade rapidjson-docUpgrade rapidjson-develUpgrade mysql8.4-errmsg | Sep 15, 2025 | Jun 7, 2025 |
| Redhat_linux | — | Upgrade mecab-ipadic-EUCJP-2.7.0.20070801Upgrade mecab-ipadic-2.7.0.20070801Upgrade mysql-common-8.4.6Upgrade rapidjson-devel-1.1.0Upgrade mysql-devel-debuginfo-8.4.6Upgrade mysql-test-debuginfo-8.4.6Upgrade mecab-debuginfo-0.996Upgrade mysql-debugsource-8.4.6Upgrade mysql-test-data-8.4.6Upgrade rapidjson-doc-1.1.0Upgrade mysql-8.4.6Upgrade mysql-devel-8.4.6Upgrade mysql-server-8.4.6Upgrade mecab-debugsource-0.996Upgrade mysql-libs-debuginfo-8.4.6Upgrade mysql-test-8.4.6Upgrade mysql-libs-8.4.6Upgrade mysql-debuginfo-8.4.6Upgrade mysql-server-debuginfo-8.4.6Upgrade mecab-devel-0.996Upgrade mecab-0.996Upgrade mysql-errmsg-8.4.6 | Jul 17, 2025 | Jun 7, 2025 |
| Rocky_linux | — | Upgrade mysql8.4-libsUpgrade mysql8.4-serverUpgrade mysql8.4-debuginfoUpgrade mysql8.4-debugsourceUpgrade mysql8.4-libs-debuginfoUpgrade mysql8.4-develUpgrade mysql8.4-devel-debuginfoUpgrade mysql8.4-test-debuginfoUpgrade mysql8.4-testUpgrade mysql8.4-server-debuginfoUpgrade mysql8.4 | Feb 5, 2026 | Oct 3, 2025 |
| Suse | — | Upgrade curlUpgrade libcurl-mini4Upgrade libcurl-devel-docUpgrade curl-zsh-completionUpgrade libcurl4-32bitUpgrade libcurl-devel-32bitUpgrade libcurl-develUpgrade libcurl4 | Sep 15, 2025 | Sep 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub