Loading vulnerability…
Proxy cache poisoning through predictable WebSocket masking in curl
CVE-2025-10148 affects curl's WebSocket implementation, which reuses a fixed 32-bit masking pattern throughout a connection instead of selecting a new mask for each outgoing frame as required by the WebSocket specification. A malicious WebSocket server can exploit the predictable mask to induce traffic that a configured or transparent intermediary proxy interprets as genuine HTTP content. This can poison the proxy's cache, allowing attacker-controlled cached content to be served to other users.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can poison an intermediary proxy's cache and cause poisoned content to be served to users sharing that proxy. The consequences extend beyond the vulnerable curl client to consumers of the affected cache. This vulnerability does not establish arbitrary code execution or direct compromise of the curl host.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. Pending patching, apply appropriate network access controls to affected systems and follow vendor security configuration guidance. These general protections do not correct the predictable WebSocket masking behavior.
Patch, then assume compromise.
Install vendor updates that correct curl's WebSocket masking behavior. For Echo packages, update curl and related packages to 8.14.1-2+e1 or later. For Google Container-Optimized OS, apply the update identified as 19216.220.24 or later that includes the curl fix. For Siemens COMOS V10.4.5 releases earlier than V10.4.5.0.2, obtain the patch and update instructions from Siemens support; update COMOS V10.6 to V10.6.1 or later. Fixes are also included in VMware Tanzu Kubernetes Grid Integrated Edition CLI and Tile 1.23.4, GemFire Session Management 2.0.0, and GemFire Vector Database 2.0.0.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.