WebSocket Vulnerability in curl Affects Multiple Versions

CVE-2025-10148

What is CVE-2025-10148?

The WebSocket implementation in curl has a vulnerability that does not update the 32-bit mask pattern for each new outgoing frame, resulting in a predictable mask. This flaw permits a malicious server to generate traffic that could be misinterpreted as legitimate HTTP traffic by proxies. Consequently, an attacker could poison the cache of such proxies, distributing manipulated content to all users. The risk of serving corrupted data underscores the necessity for immediate remedial actions to safeguard against exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References