CVE-2025-5399

Updated: 2025-08-20 03:18:46.874516

Description:

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS libcurl-using application.


Links NIST CIRCL RHEL Ubuntu

Severity

Severity Score
CVSS Version 2.x NONE 0.0
CVSS Version 3.x MEDIUM 4.3

Status

OS name Project name Version Score Severity Status Errata Last updated

Statement

AlmaLinux 9.2 ESU mysql 8.0.32 4.3 MEDIUM Released CLSA-2025:1766409829 2025-12-22 17:04:25 This issue is a client-side, application-scoped DoS in libcurl’s WebSocket code: it only triggers ...
AlmaLinux 9.2 ESU curl 7.76.1 4.3 MEDIUM Ignored 2025-09-23 08:00:11 This issue is a client-side, application-scoped DoS in libcurl’s WebSocket code: it only triggers ...