curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. (CVE-2025-10148)
A vulnerability in curl's WebSocket implementation caused the 32-bit mask pattern to remain fixed for the entire connection instead of updating for each outgoing frame as required by the WebSocket specification. This predictable mask pattern could allow a malicious server to poison proxy caches with malicious content, potentially affecting all users relying on the proxy. The issue affects certain Ubuntu package versions and has a CVSS score of 5.3 (low severity). A patch is available from Ubuntu.
AI Analysis
Technical Summary
curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the WebSocket specification mandates. Instead, it used a fixed mask throughout the connection. This predictable mask pattern could be exploited by a malicious server to induce traffic that a proxy might interpret as legitimate HTTP content, thereby poisoning its cache. The vulnerability affects specific Ubuntu curl package versions. The issue has been assigned CVE-2025-10148 and has a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Ubuntu has released patches to address this vulnerability.
Potential Impact
The vulnerability allows a malicious server to exploit the predictable WebSocket mask pattern to poison proxy caches with malicious content. This poisoned cache content could then be served to all users of the affected proxy, potentially leading to widespread cache poisoning. The impact is limited to cache poisoning with low confidentiality impact and no integrity or availability impact.
Mitigation Recommendations
A patch is available and should be applied. Ubuntu has released updated curl packages that fix this issue. Users should update to the fixed package versions as listed in the Ubuntu advisory USN-8062-1. Applying the official patch fully mitigates the vulnerability.
curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. (CVE-2025-10148)
Description
A vulnerability in curl's WebSocket implementation caused the 32-bit mask pattern to remain fixed for the entire connection instead of updating for each outgoing frame as required by the WebSocket specification. This predictable mask pattern could allow a malicious server to poison proxy caches with malicious content, potentially affecting all users relying on the proxy. The issue affects certain Ubuntu package versions and has a CVSS score of 5.3 (low severity). A patch is available from Ubuntu.
CVSS v3.1
Score 5.3medium
Affected software
pkg:deb/ubuntu/curl?arch=source&distro=noblepkg:deb/ubuntu/curl?arch=source&distro=questingRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the WebSocket specification mandates. Instead, it used a fixed mask throughout the connection. This predictable mask pattern could be exploited by a malicious server to induce traffic that a proxy might interpret as legitimate HTTP content, thereby poisoning its cache. The vulnerability affects specific Ubuntu curl package versions. The issue has been assigned CVE-2025-10148 and has a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Ubuntu has released patches to address this vulnerability.
Potential Impact
The vulnerability allows a malicious server to exploit the predictable WebSocket mask pattern to poison proxy caches with malicious content. This poisoned cache content could then be served to all users of the affected proxy, potentially leading to widespread cache poisoning. The impact is limited to cache poisoning with low confidentiality impact and no integrity or availability impact.
Mitigation Recommendations
A patch is available and should be applied. Ubuntu has released updated curl packages that fix this issue. Users should update to the fixed package versions as listed in the Ubuntu advisory USN-8062-1. Applying the official patch fully mitigates the vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2025-10148
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:24.04:LTS","Ubuntu:25.10"]
- Cvss Version
- 3.1
Patch Information
Threat ID: 6ab4be70f7a7c54106f0d455
Added to database: 09/24/2026, 06:08:48 UTC
Last enriched: 09/24/2026, 06:54:12 UTC
Last updated: 09/24/2026, 06:54:12 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.