CVE-2025-10148

Katalog CVE

CVSS 5.3 · Medium EPSS 0,50%

Kerentanan Generation of Predictable Numbers or Identifiers pada haxx curl. Skor CVSS 3.1 5.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.

Rincian

Terbit di NVD

12 September 2025

Terakhir diubah

15 September 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-340: Generation of Predictable Numbers or Identifiers

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 41,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://curl.se/docs/CVE-2025-10148.html patch · advisory vendor
• https://curl.se/docs/CVE-2025-10148.json advisory vendor
• http://www.openwall.com/lists/oss-security/2025/09/10/2 mailing list · patch · advisory pihak ketiga
• https://hackerone.com/reports/3330839 issue tracking · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2025/09/10/3 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2025/09/10/4 mailing list · advisory pihak ketiga