VYPR
← All advisories
Unrated severityNVD Advisory· Published Jun 7, 2025· Updated Jun 9, 2025

WebSocket endless loop

CVE-2025-5399

Description

A crafted WebSocket packet can cause libcurl to enter an infinite busy-loop, leading to denial of service in applications using libcurl versions 8.13.0 through 8.14.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A crafted WebSocket packet can cause libcurl to enter an infinite busy-loop, leading to denial of service in applications using libcurl versions 8.13.0 through 8.14.0.

Vulnerability

A flaw in libcurl's WebSocket handling code causes an infinite busy-loop when a malicious server sends a specially crafted packet. The loop has no exit condition, trapping the application indefinitely. The bug affects libcurl versions 8.13.0 to 8.14.0 inclusive; versions before 8.13.0 and after 8.14.0 are not vulnerable. The issue does not affect the curl command-line tool [1].

Exploitation

An attacker must operate a WebSocket server that the victim application connects to. No authentication or prior access is required. The attacker sends a single crafted WebSocket packet to the client; upon processing, libcurl enters the endless busy-loop. The application cannot escape the loop except by killing the thread or process [1].

Impact

Successful exploitation results in a denial of service (DoS). The affected application becomes unresponsive and must be terminated. No data confidentiality or integrity is compromised; the attack only affects availability [1].

Mitigation

Upgrade to libcurl version 8.14.1, released on June 4, 2025, which contains the fix. Alternatively, apply the patch from commit d1145df24de8f80e6b16. As a workaround, disable auto-pong by setting the CURLWS_NOAUTOPONG option, which prevents the vulnerable code path. Avoid using WebSocket functionality if neither upgrade nor workaround is possible [1].

References
  1. curl - WebSocket endless loop

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

25

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

3

News mentions

0

No linked articles in our index yet.