High severity7.5NVD Advisory· Published Jun 7, 2025· Updated Jun 17, 2026
CVE-2025-5399
CVE-2025-5399
Description
Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.
There is no other way for the application to escape or exit this loop other than killing the thread/process.
This might be used to DoS libcurl-using application.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
25- osv-coords23 versionspkg:rpm/almalinux/mecabpkg:rpm/almalinux/mecab-develpkg:rpm/almalinux/mecab-ipadicpkg:rpm/almalinux/mecab-ipadic-EUCJPpkg:rpm/almalinux/mysqlpkg:rpm/almalinux/mysql8.4-commonpkg:rpm/almalinux/mysql8.4-errmsgpkg:rpm/almalinux/mysql8.4-test-datapkg:rpm/almalinux/mysql-commonpkg:rpm/almalinux/mysql-develpkg:rpm/almalinux/mysql-errmsgpkg:rpm/almalinux/mysql-libspkg:rpm/almalinux/mysql-selinuxpkg:rpm/almalinux/mysql-serverpkg:rpm/almalinux/mysql-testpkg:rpm/almalinux/mysql-test-datapkg:rpm/almalinux/rapidjson-develpkg:rpm/almalinux/rapidjson-docpkg:rpm/opensuse/curl&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/curl&distro=openSUSE%20Tumbleweedpkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7pkg:rpm/suse/curl&distro=SUSE%20Linux%20Micro%206.1
< 0.996-3.module_el9.6.0+152+8cbce00c.4+ 22 more
- (no CPE)range: < 0.996-3.module_el9.6.0+152+8cbce00c.4
- (no CPE)range: < 0.996-3.module_el9.6.0+152+8cbce00c.4
- (no CPE)range: < 2.7.0.20070801-24.module_el9.6.0+152+8cbce00c
- (no CPE)range: < 2.7.0.20070801-24.module_el9.6.0+152+8cbce00c
- (no CPE)range: < 8.4.6-1.module_el9.6.0+180+a4e757e5
- (no CPE)range: < 8.4.6-2.el10_0
- (no CPE)range: < 8.4.6-2.el10_0
- (no CPE)range: < 8.4.6-2.el10_0
- (no CPE)range: < 8.4.6-1.module_el9.6.0+180+a4e757e5
- (no CPE)range: < 8.4.6-1.module_el9.6.0+180+a4e757e5
- (no CPE)range: < 8.4.6-1.module_el9.6.0+180+a4e757e5
- (no CPE)range: < 8.4.6-1.module_el9.6.0+180+a4e757e5
- (no CPE)range: < 1.0.14-1.el10_0
- (no CPE)range: < 8.4.6-1.module_el9.6.0+180+a4e757e5
- (no CPE)range: < 8.4.6-1.module_el9.6.0+180+a4e757e5
- (no CPE)range: < 8.4.6-1.module_el9.6.0+180+a4e757e5
- (no CPE)range: < 1.1.0-19.module_el9.6.0+152+8cbce00c
- (no CPE)range: < 1.1.0-19.module_el9.6.0+152+8cbce00c
- (no CPE)range: < 8.14.1-150600.4.28.1
- (no CPE)range: < 8.14.1-4.1
- (no CPE)range: < 8.14.1-150600.4.28.1
- (no CPE)range: < 8.14.1-150600.4.28.1
- (no CPE)range: < 8.14.1-slfo.1.1_1.1
Patches
Vulnerability mechanics
References
4- hackerone.com/reports/3168039nvdExploitIssue TrackingThird Party Advisory
- www.openwall.com/lists/oss-security/2025/06/04/2nvdMailing ListThird Party Advisory
- curl.se/docs/CVE-2025-5399.htmlnvdVendor Advisory
- curl.se/docs/CVE-2025-5399.jsonnvdVendor Advisory
News mentions
0No linked articles in our index yet.