CVE-2025-10148 — predictable WebSocket mask

Back Back to CVE browser

MEDIUM

predictable WebSocket mask

Published Sep 12, 2025

5.3

MEDIUM

CVSS 3.1

EPSS 0.50%

Description

curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection.

A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.

Affected products

Vendor Curl Product Curl Default
unaffected
- Version
  8.11.0
  Status
  affected
  Constraints
  <8.14.2
- Version
  8.11.0
  Status
  affected
  Constraints
  -
- Version
  8.11.1
  Status
  affected
  Constraints
  -
- Version
  8.12.0
  Status
  affected
  Constraints
  -
- Version
  8.12.1
  Status
  affected
  Constraints
  -
- Version
  8.13.0
  Status
  affected
  Constraints
  -
- Version
  8.14.0
  Status
  affected
  Constraints
  -
- Version
  8.14.1
  Status
  affected
  Constraints
  -
- Version
  8.15.0
  Status
  affected
  Constraints
  <8.16.0
- Version
  8.15.0
  Status
  affected
  Constraints
  -
Vendor Curl Product Curl Default
unaffected
- Version
  
  Status
  affected
  Constraints

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Curl

unaffected

Version	Status	Constraints
8.11.0	affected	<8.14.2
8.11.0	affected	-
8.11.1	affected	-
8.12.0	affected	-
8.12.1	affected	-
8.13.0	affected	-
8.14.0	affected	-
8.14.1	affected	-
8.15.0	affected	<8.16.0
8.15.0	affected	-

Curl

unaffected

Version	Status	Constraints
	affected

Red Hat Hardened Images

curl-main-8.19.0-3.hum1

Fixed · RHSA-2026:6893
Red Hat Enterprise Linux 10

curl

Fix deferred
Red Hat Enterprise Linux 6

curl

Not affected
Red Hat Enterprise Linux 7

curl

Not affected
Red Hat Enterprise Linux 8

curl

Not affected
Red Hat Enterprise Linux 9

curl

Not affected
Red Hat JBoss Core Services

curl

Fix deferred
Red Hat OpenShift Container Platform 4

openshift/ose-rhel-coreos-8

Not affected
Red Hat OpenShift Container Platform 4

openshift/ose-rhel-coreos-9

Not affected
Red Hat OpenShift Dev Spaces

devspaces/code-rhel9

Not affected
Red Hat Trusted Profile Analyzer

rhtpa/rhtpa-trustification-service-rhel9

Not affected

Product	Package	State	Advisory
Red Hat Hardened Images	curl-main-8.19.0-3.hum1	Fixed	RHSA-2026:6893
Red Hat Enterprise Linux 10	curl	Fix deferred	n/a
Red Hat Enterprise Linux 6	curl	Not affected	n/a
Red Hat Enterprise Linux 7	curl	Not affected	n/a
Red Hat Enterprise Linux 8	curl	Not affected	n/a
Red Hat Enterprise Linux 9	curl	Not affected	n/a
Red Hat JBoss Core Services	curl	Fix deferred	n/a
Red Hat OpenShift Container Platform 4	openshift/ose-rhel-coreos-8	Not affected	n/a
Red Hat OpenShift Container Platform 4	openshift/ose-rhel-coreos-9	Not affected	n/a
Red Hat OpenShift Dev Spaces	devspaces/code-rhel9	Not affected	n/a
Red Hat Trusted Profile Analyzer	rhtpa/rhtpa-trustification-service-rhel9	Not affected	n/a

Remediation

Red Hat statement

To exploit this issue, a curl application must be communicating through a defective proxy that confuses a WebSocket for HTTP traffic. Additionally, this flaw requires the traffic to be done using clear text HTTP / WebSocket (ws://) and not over TLS (wss://).

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Metrics

0.50% 0.00499

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.00499

Score over time

2025–2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	0.50% (0.00499)	40.58th	v5 (v2026.06.15)
Jun 15, 2026	0.47% (0.00466)	36.55th	v5 (v2026.06.15)
Sep 12, 2025	0.02% (0.00017)	2.64th	v4 (v2025.03.14)

Weaknesses (1)

CWE-340

References (10)

http://www.openwall.com/lists/oss-security/2025/09/10/2
Mailing ListPatchThird Party Advisory
http://www.openwall.com/lists/oss-security/2025/09/10/3
Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2025/09/10/4
Mailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2025-10148
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2394749
Issue Tracking
https://curl.se/docs/CVE-2025-10148.html
PatchVendor Advisory
https://curl.se/docs/CVE-2025-10148.json
Vendor Advisory
https://hackerone.com/reports/3330839
Issue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-10148
https://www.cve.org/CVERecord?id=CVE-2025-10148

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2025/09/10/2		Mailing ListPatchThird Party Advisory
http://www.openwall.com/lists/oss-security/2025/09/10/3		Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2025/09/10/4		Mailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2025-10148		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2394749		Issue Tracking
https://curl.se/docs/CVE-2025-10148.html		PatchVendor Advisory
https://curl.se/docs/CVE-2025-10148.json		Vendor Advisory
https://hackerone.com/reports/3330839		Issue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-10148
https://www.cve.org/CVERecord?id=CVE-2025-10148