CVE-2025-10148 predictable WebSocket mask
A predictable WebSocket mask in curl allows malicious servers to poison proxy caches, serving modified content to users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-10148?
CVE-2025-10148 is a medium-severity vulnerability in Haxx Curl, published on 12 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection.
A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.
Weakness: CWE-340
Which versions are affected by CVE-2025-10148?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2025-10148?
Upgrade to a fixed version.
Is CVE-2025-10148 being exploited?
There is no known exploitation of CVE-2025-10148 in the wild and no public exploit code.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2025-10148, AZL-67082, AZL-67272, AZL-67290, BELL-CVE-2025-10148, CLEANSTART-2026-US71210 and 8 more.