CVE-2025-10148 is a medium severity vulnerability in curl's websocket implementation where the 32-bit mask pattern used for outgoing frames was not updated per the specification. Instead, a fixed mask was reused throughout the connection. This predictable mask can allow a malicious server to manipulate traffic such that an involved proxy may cache poisoned HTTP content, potentially serving it to other users.