CVE-2025-10148: predictable WebSocket mask
curl's websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection.
A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10148?
CVE-2025-10148 is considered to be of medium severity due to the potential for traffic manipulation by a malicious server.
How do I fix CVE-2025-10148?
To fix CVE-2025-10148, update to the latest version of curl that has addressed the websocket mask pattern issue.
What is the impact of CVE-2025-10148?
The impact of CVE-2025-10148 is that it allows a malicious server to induce traffic, potentially leading to data exposure.
Which versions of curl are affected by CVE-2025-10148?
CVE-2025-10148 affects all versions of curl that utilize the websocket code with the flawed mask pattern.
Is there a workaround for CVE-2025-10148?
Currently, there are no official workarounds for CVE-2025-10148 other than upgrading to a patched version of curl.