CVE-2025-5399 WebSocket endless loop

What is CVE-2025-5399?

CVE-2025-5399 is a high-severity denial of service vulnerability in Haxx Curl, published on 7 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.

There is no other way for the application to escape or exit this loop other than killing the thread/process.

This might be used to DoS libcurl-using application.

Weakness: CWE-835

Which versions are affected by CVE-2025-5399?

It affects 1 product.

Products include Haxx Curl.

How do I fix CVE-2025-5399?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-5399 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-5399 exists.

Other vulnerabilities in Haxx Curl

• CVE-2026-19931 Negotiate ambient user conn reuse Critical 9.8
• CVE-2026-10536 HTTP/2 stream-dependency tree UAF Critical 9.8
• CVE-2026-11856 cross-origin Digest auth state leak Critical 9.8
• CVE-2026-8925 SASL double-free Critical 9.8
• CVE-2026-9079 stale proxy password leak Critical 9.8

All Haxx Curl vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2025-5399, BELL-CVE-2025-5399, CLEANSTART-2026-YU63094, CURL-CVE-2025-5399, DEBIAN-CVE-2025-5399, ECHO-0bd5-994d-5bb9 and 4 more.