CVE-2025-5399
ADVISORY - nistSummary
Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.
There is no other way for the application to escape or exit this loop other than killing the thread/process.
This might be used to DoS libcurl-using application.
EPSS Score: 0.00043 (0.130)
Common Weakness Enumeration (CWE)
ADVISORY - nist
Loop with Unreachable Exit Condition ('Infinite Loop')
Alpine
CREATED
UPDATED
ADVISORY IDCVE-2025-5399
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
| Package | Type | OS Name | OS Version | Affected Ranges | Fix Versions |
|---|---|---|---|---|---|
| alpine/curl | apk | alpine | 3.20 | <8.14.1-r0 | 8.14.1-r0 |
| alpine/curl | apk | alpine | 3.20 | <8.14.1-r0 | 8.14.1-r0 |
| alpine/curl | apk | alpine | edge | <8.14.1-r0 | 8.14.1-r0 |
| alpine/curl | apk | alpine | edge | <=8.11.0-r2 | Not yet available |
| alpine/curl | apk | alpine | edge | <=8.11.1-r0 | Not yet available |
| alpine/curl | apk | alpine | edge | <=8.11.1-r1 | Not yet available |
| alpine/curl | apk | alpine | edge | <=8.12.0-r0 | Not yet available |
| alpine/curl | apk | alpine | edge | <=8.12.1-r0 | Not yet available |
| alpine/curl | apk | alpine | edge | <=8.12.1-r1 | Not yet available |
| alpine/curl | apk | alpine | edge | <=8.13.0-r0 | Not yet available |
| alpine/curl | apk | alpine | edge | <=8.13.0-r1 | Not yet available |
| alpine/curl | apk | alpine | edge | <=8.14.0-r0 | Not yet available |
| alpine/curl | apk | alpine | edge | <=8.14.0-r1 | Not yet available |
| alpine/curl | apk | alpine | edge | <=8.14.0-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <8.14.1-r0 | 8.14.1-r0 |
| alpine/curl | apk | alpine | 3.19 | <=8.11.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.11.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.12.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.12.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.9.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <8.14.1-r0 | 8.14.1-r0 |
| alpine/curl | apk | alpine | 3.19 | <8.14.1-r0 | 8.14.1-r0 |
| alpine/curl | apk | alpine | edge | <8.14.1-r0 | 8.14.1-r0 |
| alpine/curl | apk | alpine | 3.23 | <8.14.1-r0 | 8.14.1-r0 |
| alpine/curl | apk | alpine | 3.20 | <=8.11.0-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.11.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.11.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.12.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.12.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <8.14.1-r0 | 8.14.1-r0 |
| alpine/curl | apk | alpine | 3.21 | <=8.11.0-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.11.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.11.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.12.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.12.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.12.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <8.14.1-r0 | 8.14.1-r0 |
Severity and metrics
No CVSS data available from this advisory.
NIST
CREATED
UPDATED
ADVISORY IDCVE-2025-5399
EXPLOITABILITY SCORE
3.9
EXPLOITS FOUND
COMMON WEAKNESS ENUMERATION (CWE)
CVSS SCORE
7.5highDebian
CREATED
UPDATED
ADVISORY IDCVE-2025-5399
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AlowUbuntu
CREATED
UPDATED
ADVISORY IDCVE-2025-5399
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AlowAlma
CREATED
UPDATED
ADVISORY IDALSA-2025:16046
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AmediumRocky
CREATED
UPDATED
ADVISORY IDRLSA-2025:15699
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AlowOracle
CREATED
UPDATED
ADVISORY IDELSA-2025-15699
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AmediumOracle
CREATED
UPDATED
ADVISORY IDELSA-2025-16046
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/Amediumminimos
CREATED
UPDATED
ADVISORY ID
MINI-ppm5-3j96-36r2
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-