CVE-2025-10148: predictable WebSocket mask
curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.5.0-2ubuntu10.7 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.14.1-2ubuntu1.1 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u15Fixed in 8.14.1-2+deb13u5Fixed in 8.14.1-2+deb13u7Fixed in 8.22.0-1Fixed in 8.23.0-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10148?
CVE-2025-10148 is considered to be of medium severity due to the potential for traffic manipulation by a malicious server.
How do I fix CVE-2025-10148?
To fix CVE-2025-10148, update to the latest version of curl that has addressed the websocket mask pattern issue.
What is the impact of CVE-2025-10148?
The impact of CVE-2025-10148 is that it allows a malicious server to induce traffic, potentially leading to data exposure.
Which versions of curl are affected by CVE-2025-10148?
CVE-2025-10148 affects all versions of curl that utilize the websocket code with the flawed mask pattern.
Is there a workaround for CVE-2025-10148?
Currently, there are no official workarounds for CVE-2025-10148 other than upgrading to a patched version of curl.