CVE-2025-5399: WebSocket endless loop
Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.
There is no other way for the application to escape or exit this loop other than killing the thread/process.
This might be used to DoS libcurl-using application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5399?
CVE-2025-5399 has a moderate severity due to the potential for an endless busy-loop in libcurl.
How do I fix CVE-2025-5399?
To mitigate CVE-2025-5399, upgrade to the latest version of libcurl that addresses this vulnerability.
What impact does CVE-2025-5399 have on applications using libcurl?
CVE-2025-5399 can cause applications using libcurl to become unresponsive due to an endless busy-loop.
Who is affected by CVE-2025-5399?
Any application using the vulnerable versions of libcurl with WebSocket functionality is affected by CVE-2025-5399.
What should I do if I'm unable to upgrade to fix CVE-2025-5399?
If upgrading is not possible, consider implementing safeguards to monitor and kill unresponsive processes caused by CVE-2025-5399.