---
id: CVE-2025-10148
title: |-
  curl's WebSocket code did not update the 32-bit mask pattern for each new
  outgoing frame as the specification says
summary: |-
  curl's WebSocket code did not update the 32-bit mask pattern for each new
  outgoing frame as the specification says. Instead it used a fixed mask that
  persisted and was used throughout the entire connection.

  A predictable mask pattern al…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-340
vendor: haxx
product: curl
affected:
  - 'curl >= 8.11.0, < 8.16.0'
patched:
  - curl 8.16.0
published: '2025-09-12'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T07:16:21.967'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-10148'
references:
  - url: 'https://curl.se/docs/CVE-2025-10148.html'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://curl.se/docs/CVE-2025-10148.json'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://hackerone.com/reports/3330839'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/10/2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/10/3'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/10/4'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-09-12T17:16:46.486840Z'
epss: 0.00499
epssPercentile: 0.41819
ingestedAt: '2026-09-15T07:33:29.255Z'
---

## Overview

curl's WebSocket code did not update the 32-bit mask pattern for each new
outgoing frame as the specification says. Instead it used a fixed mask that
persisted and was used throughout the entire connection.

A predictable mask pattern allows for a malicious server to induce traffic
between the two communicating parties that could be interpreted by an involved
proxy (configured or transparent) as genuine, real, HTTP traffic with content
and thereby poison its cache. That cached poisoned content could then be
served to all users of that proxy.

## Affected

- `curl >= 8.11.0, < 8.16.0`

## Remediation

Upgrade past the affected range:

- `curl 8.16.0`