CVE-2025-10148

{
  "id": "CVE-2025-10148",
  "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
  "published": "2025-09-12T06:15:40.020",
  "lastModified": "2026-10-19T17:10:00.173",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy."
    },
    {
      "lang": "es",
      "value": "El código websocket de curl no actualizó el patrón de máscara de 32 bits para cada nuevo frame saliente como indica la especificación. En su lugar, utilizó una máscara fija que persistió y se usó durante toda la conexión.\n\nUn patrón de máscara predecible permite que un servidor malicioso induzca tráfico entre las dos partes comunicantes que podría ser interpretado por un proxy involucrado (configurado o transparente) como tráfico HTTP genuino, real, con contenido y así envenenar su caché. Ese contenido envenenado en caché podría entonces ser servido a todos los usuarios de ese proxy."
    }
  ],
  "affected": [
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "affectedData": [
        {
          "vendor": "curl",
          "product": "curl",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "8.11.0",
              "lessThan": "8.14.2",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.15.0",
              "lessThan": "8.16.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "curl",
          "product": "curl",
          "defaultStatus": "unaffected",
          "repo": "https://github.com/curl/curl.git",
          "versions": [
            {
              "version": "d78e129d50b2d190f1c1bde2ad1f62f02f152db0",
              "lessThan": "84db7a9eae8468c0445b15aa806fa7fa806fa0f2",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "curl",
          "product": "curl",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "8.15.0",
              "status": "affected"
            },
            {
              "version": "8.14.1",
              "status": "affected"
            },
            {
              "version": "8.14.0",
              "status": "affected"
            },
            {
              "version": "8.13.0",
              "status": "affected"
            },
            {
              "version": "8.12.1",
              "status": "affected"
            },
            {
              "version": "8.12.0",
              "status": "affected"
            },
            {
              "version": "8.11.1",
              "status": "affected"
            },
            {
              "version": "8.11.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-12T17:16:46.486840Z",
          "id": "CVE-2025-10148",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-340"
        }
      ]
    },
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.11.0",
              "versionEndExcluding": "8.16.0",
              "matchCriteriaId": "A2D88104-00EB-4B8B-88D4-9FCCEF41FA6B"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://curl.se/docs/CVE-2025-10148.html",
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://curl.se/docs/CVE-2025-10148.json",
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://hackerone.com/reports/3330839",
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/09/10/2",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/09/10/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/09/10/4",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    }
  ]
}