curl's websocket code did not update the 32 bit mask pattern for each new
outgoing frame as the specification says. Instead it used a fixed mask that
persisted and was used throughout the entire connection.
A predictable mask pattern allows for a malicious server to induce traffic
between the two communicating parties that could be interpreted by an involved
proxy (configured or transparent) as genuine, real, HTTP traffic with content
and thereby poison its cache. That cached poisoned content could then be
served to all users of that proxy.
outgoing frame as the specification says. Instead it used a fixed mask that
persisted and was used throughout the entire connection.
A predictable mask pattern allows for a malicious server to induce traffic
between the two communicating parties that could be interpreted by an involved
proxy (configured or transparent) as genuine, real, HTTP traffic with content
and thereby poison its cache. That cached poisoned content could then be
served to all users of that proxy.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 12 Sep 2025 05:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | curl's websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy. | |
| Title | predictable WebSocket mask | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: curl
Published:
Updated: 2025-09-12T05:10:37.469Z
Reserved: 2025-09-09T03:45:41.908Z
Link: CVE-2025-10148
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-09-12T06:15:40.020
Modified: 2025-09-12T06:15:40.020
Link: CVE-2025-10148
Redhat
No data.
OpenCVE Enrichment
No data.