MediumFix available
curl — security advisory
curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.
- Products
- curl
- Affected versions
- 7.88.1-10, 7.88.1-10+deb12u1, 7.88.1-10+deb12u11, 7.88.1-10+deb12u12, 7.88.1-10+deb12u13, 7.88.1-10+deb12u14, 7.88.1-10+deb12u1~bpo11+1, 7.88.1-10+deb12u2, 7.88.1-10+deb12u3, 7.88.1-10+deb12u3~bpo11+1, 7.88.1-10+deb12u4, 7.88.1-10+deb12u5, 7.88.1-10+deb12u5~bpo11+1, 7.88.1-10+deb12u6, 7.88.1-10+deb12u6~bpo11+1, 7.88.1-10+deb12u7, 7.88.1-10+deb12u8, 7.88.1-10+deb12u9, 8.14.1-2, 8.14.1-2+exp1, 8.15.0-1, 8.15.0-1~bpo13+1, 8.15.0-1~exp1, 8.15.0~rc1-1exp1, 8.15.0~rc2-1~exp1, 8.15.0~rc3-1~exp1, 8.16.0-1~bpo13+1, 8.16.0~rc1-1~exp1, 8.16.0~rc2-1, 8.16.0~rc2-2, 8.16.0~rc3-1
- Fixed versions
- 7.88.1-10+deb12u15, 8.14.1-2+deb13u1, 8.16.0-1
- CVEs
- CVE-2025-10148
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 22:40 UTC · Revision 1
Source evidence
curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.
osv:DEBIAN-CVE-2025-10148
curl
Fixed versions: 7.88.1-10+deb12u15
curl
Fixed versions: 8.14.1-2+deb13u1
curl
Fixed versions: 8.16.0-1
Complete source record
{
"id": "9e84fb61d88dc49f47e7edc859b123dd28b7415c0b6de0e9aba395a7f3d23081",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2025-10148",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2025-10148",
"summary": "curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.",
"evidence": "osv:DEBIAN-CVE-2025-10148",
"products": [
{
"name": {
"value": "curl",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.88.1-10+deb12u15",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "7.88.1-10",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u11",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u12",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u13",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u14",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u1~bpo11+1",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u2",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u3",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u3~bpo11+1",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u4",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u5",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u5~bpo11+1",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u6",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u6~bpo11+1",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u7",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u8",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u9",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "curl",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.14.1-2+deb13u1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "8.14.1-2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "curl",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.16.0-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "8.14.1-2",
"evidence": "/affected/2/versions"
},
{
"value": "8.14.1-2+exp1",
"evidence": "/affected/2/versions"
},
{
"value": "8.15.0-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.15.0-1~bpo13+1",
"evidence": "/affected/2/versions"
},
{
"value": "8.15.0-1~exp1",
"evidence": "/affected/2/versions"
},
{
"value": "8.15.0~rc1-1exp1",
"evidence": "/affected/2/versions"
},
{
"value": "8.15.0~rc2-1~exp1",
"evidence": "/affected/2/versions"
},
{
"value": "8.15.0~rc3-1~exp1",
"evidence": "/affected/2/versions"
},
{
"value": "8.16.0-1~bpo13+1",
"evidence": "/affected/2/versions"
},
{
"value": "8.16.0~rc1-1~exp1",
"evidence": "/affected/2/versions"
},
{
"value": "8.16.0~rc2-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.16.0~rc2-2",
"evidence": "/affected/2/versions"
},
{
"value": "8.16.0~rc3-1",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2025-10148",
"aliases": [
"DEBIAN-CVE-2025-10148"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.88.1-10+deb12u15"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:deb/debian/curl?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"7.88.1-10",
"7.88.1-10+deb12u1",
"7.88.1-10+deb12u11",
"7.88.1-10+deb12u12",
"7.88.1-10+deb12u13",
"7.88.1-10+deb12u14",
"7.88.1-10+deb12u1~bpo11+1",
"7.88.1-10+deb12u2",
"7.88.1-10+deb12u3",
"7.88.1-10+deb12u3~bpo11+1",
"7.88.1-10+deb12u4",
"7.88.1-10+deb12u5",
"7.88.1-10+deb12u5~bpo11+1",
"7.88.1-10+deb12u6",
"7.88.1-10+deb12u6~bpo11+1",
"7.88.1-10+deb12u7",
"7.88.1-10+deb12u8",
"7.88.1-10+deb12u9"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-10148.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.14.1-2+deb13u1"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:deb/debian/curl?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"8.14.1-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-10148.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.16.0-1"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:deb/debian/curl?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"8.14.1-2",
"8.14.1-2+exp1",
"8.15.0-1",
"8.15.0-1~bpo13+1",
"8.15.0-1~exp1",
"8.15.0~rc1-1exp1",
"8.15.0~rc2-1~exp1",
"8.15.0~rc3-1~exp1",
"8.16.0-1~bpo13+1",
"8.16.0~rc1-1~exp1",
"8.16.0~rc2-1",
"8.16.0~rc2-2",
"8.16.0~rc3-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-10148.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T17:47:26.933753953Z",
"provider": "osv",
"upstream": [
"CVE-2025-10148"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2025-10148"
]
},
"related_cves": [
{
"value": "CVE-2025-10148",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 416985,
"published_at": "2025-09-12T06:15:40.02+00:00"
}