Description
curl's WebSocket code did not update the 32-bit mask pattern for each new
outgoing frame as the specification says. Instead it used a fixed mask that
persisted and was used throughout the entire connection.
A predictable mask pattern allows for a malicious server to induce traffic
between the two communicating parties that could be interpreted by an involved
proxy (configured or transparent) as genuine, real, HTTP traffic with content
and thereby poison its cache. That cached poisoned content could then be
served to all users of that proxy.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| curl | curl | 8.11.0 – < 8.14.2, 8.15.0 – < 8.16.0, 8.15.0, 8.14.1, 8.14.0, 8.13.0, 8.12.1, 8.12.0, 8.11.1, 8.11.0 | 8.14.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 8.16.0-1 | — |
| Debian 13 | curl | 8.14.1-2+deb13u1 | — |
| Debian 12 | curl | 7.88.1-10+deb12u15 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | curl | 8.14.1-2ubuntu1.1 | USN-8062-1 |
| Ubuntu 24.04 LTS | curl | 8.5.0-2ubuntu10.7 | USN-8062-1 |
| Ubuntu 22.04 LTS | curl | 7.81.0-1ubuntu1.22 | USN-8062-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | curl +3 | 8.19.0-3.hum1 | RHSA-2026:6893 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | brotli | 1.0.7-150200.3.5.1 | SUSE-SU-2025:03268-1 |
| SLES 15 SP7 | curl | 8.14.1-150600.4.28.1 | SUSE-SU-2025:03198-1 |
| SLES 15 SP6 | brotli | 1.0.7-150200.3.5.1 | SUSE-SU-2025:03268-1 |
| SLES 15 SP6 | curl | 8.14.1-150600.4.28.1 | SUSE-SU-2025:03198-1 |
| SLES 15 SP5 | brotli | 1.0.7-150200.3.5.1 | SUSE-SU-2025:03268-1 |
| SLES 15 SP5 | curl | 8.14.1-150400.5.69.1 | SUSE-SU-2025:03267-1 |
| SLES 15 SP4 | brotli | 1.0.7-150200.3.5.1 | SUSE-SU-2025:03268-1 |
| SLES 15 SP4 | curl | 8.14.1-150400.5.69.1 | SUSE-SU-2025:03267-1 |
| SLES 15 SP3 | brotli | 1.0.7-150200.3.5.1 | SUSE-SU-2025:03268-1 |
| SLES 15 SP3 | curl | 8.14.1-150200.4.91.1 | SUSE-SU-2025:03268-1 |
Show 22 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | curl | 8.0.1-11.108.1 | SUSE-SU-2025:03173-1 |
| SLES for SAP 16.0 | curl +1 | 8.14.1-160000.3.1 | SUSE-SU-2025:21145-1 |
| SLES for SAP 15 SP5 | brotli | 1.0.7-150200.3.5.1 | SUSE-SU-2025:03268-1 |
| SLES for SAP 15 SP4 | brotli | 1.0.7-150200.3.5.1 | SUSE-SU-2025:03268-1 |
| SLES for SAP 15 SP4 | curl | 8.14.1-150400.5.69.1 | SUSE-SU-2025:03267-1 |
| SLES for SAP 15 SP3 | brotli | 1.0.7-150200.3.5.1 | SUSE-SU-2025:03268-1 |
| SLES for SAP 15 SP3 | curl | 8.14.1-150200.4.91.1 | SUSE-SU-2025:03268-1 |
| SLES 16.0 | curl +1 | 8.14.1-160000.3.1 | SUSE-SU-2025:21145-1 |
| SLE Micro 6.2 | curl | 8.14.1-160000.3.1 | SUSE-SU-2025:21077-1 |
| SLE Micro 6.1 | curl | 8.14.1-slfo.1.1_2.1 | SUSE-SU-2025:20802-1 |
| SLE Micro 6.0 | curl | 8.14.1-1.1 | SUSE-SU-2025:20824-1 |
| SLE Micro 5.5 | brotli | 1.0.7-150200.3.5.1 | SUSE-SU-2025:03268-1 |
| SLE Micro 5.5 | curl | 8.14.1-150400.5.69.1 | SUSE-SU-2025:03267-1 |
| SLE Micro 5.4 | brotli | 1.0.7-150200.3.5.1 | SUSE-SU-2025:03268-1 |
| SLE Micro 5.4 | curl | 8.14.1-150400.5.69.1 | SUSE-SU-2025:03267-1 |
| SLE Micro 5.3 | brotli | 1.0.7-150200.3.5.1 | SUSE-SU-2025:03268-1 |
| SLE Micro 5.3 | curl | 8.14.1-150400.5.69.1 | SUSE-SU-2025:03267-1 |
| SLE Micro 5.2 | brotli | 1.0.7-150200.3.5.1 | SUSE-SU-2025:03268-1 |
| SLE Micro 5.2 | curl | 8.14.1-150200.4.91.1 | SUSE-SU-2025:03268-1 |
| SLE Micro 5.1 | brotli | 1.0.7-150200.3.5.1 | SUSE-SU-2025:03268-1 |
| SLE Micro 5.1 | curl | 8.14.1-150200.4.91.1 | SUSE-SU-2025:03268-1 |
| SLE HPC 15 SP5 | brotli | 1.0.7-150200.3.5.1 | SUSE-SU-2025:03268-1 |
| SLE HPC 15 SP5 | curl | 8.14.1-150400.5.69.1 | SUSE-SU-2025:03267-1 |
| SLE HPC 15 SP4 | brotli | 1.0.7-150200.3.5.1 | SUSE-SU-2025:03268-1 |
| SLE HPC 15 SP4 | curl | 8.14.1-150400.5.69.1 | SUSE-SU-2025:03267-1 |
| SLE HPC 15 SP3 | brotli | 1.0.7-150200.3.5.1 | SUSE-SU-2025:03268-1 |
| SLE HPC 15 SP3 | curl | 8.14.1-150200.4.91.1 | SUSE-SU-2025:03268-1 |
| SUSE Manager Server LTS 4.3 | brotli | 1.0.7-150200.3.5.1 | SUSE-SU-2025:03268-1 |
| SUSE Manager Server LTS 4.3 | curl | 8.14.1-150400.5.69.1 | SUSE-SU-2025:03267-1 |
| SUSE Manager Proxy LTS 4.3 | brotli | 1.0.7-150200.3.5.1 | SUSE-SU-2025:03268-1 |
| SUSE Manager Proxy LTS 4.3 | curl | 8.14.1-150400.5.69.1 | SUSE-SU-2025:03267-1 |
| SUSE Linux Enterprise Installer Updates 15 SP5 | curl | 8.14.1-150400.5.69.1 | SUSE-SU-2025:03267-1 |
| SUSE Linux Enterprise Installer Updates 15 SP4 | curl | 8.14.1-150400.5.69.1 | SUSE-SU-2025:03267-1 |
| SUSE Enterprise Storage 7.1 | brotli | 1.0.7-150200.3.5.1 | SUSE-SU-2025:03268-1 |
| SUSE Enterprise Storage 7.1 | curl | 8.14.1-150200.4.91.1 | SUSE-SU-2025:03268-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | curl | 8.16.0-1.1 | openSUSE-SU-2025:15590-1 |
| openSUSE Leap 16.0 | curl | 8.14.1-160000.3.1 | openSUSE-SU-2025:20090-1 |
| openSUSE Leap 15.6 | brotli | 1.0.7-150200.3.5.1 | SUSE-SU-2025:03268-1 |
| openSUSE Leap 15.6 | curl | 8.14.1-150600.4.28.1 | SUSE-SU-2025:03198-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | curl | 8.16.0-r0 | — |
| Alpine v3.23 | curl | 8.16.0-r0 | — |
| Alpine v3.22 | curl | 8.14.1-r2 | — |
| Alpine v3.21 | curl | 8.14.1-r2 | — |
| Alpine v3.20 | curl | 8.14.1-r2 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | curl | 8.14.1-r2 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | curl +4 | 8.15.0-4.amzn2023.0.1 | ALAS2023-2025-1351 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cmake | 3.30.3-10 | — |
| Azure Linux 3 | curl | 8.11.1-4 | — |
| Azure Linux 2 (CBL-Mariner) | curl | 8.8.0-7 | — |
Advisories 21
- WID-SEC-2025-2023 cURL: Mehrere Schwachstellen ermöglichen Manipulation von Dateien BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-2189 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- RHSA-2026:6893 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- WID-SEC-2026-1730 Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Jul 16, 2026
- USN-8062-1 curl vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2025:20090-1 Security update for curl SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15590-1 curl-8.16.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21145-1 Security update for curl SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21077-1 Security update for curl SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:03198-1 Security update for curl SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20802-1 Security update for curl SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:03173-1 Security update for curl SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20824-1 Security update for curl SUSE / openSUSE Security Updates · Mar 23, 2026
- ICSA-26-043-03 Siemens COMOS CISA ICS & IT advisories · Mar 12, 2026
- SSA-212953 SSA-212953: Multiple Vulnerabilities in COMOS Siemens ProductCERT · Mar 10, 2026
- ICSA-26-043-06 Siemens SINEC OS CISA ICS & IT advisories · Feb 25, 2026
- SSA-089022 SSA-089022: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.3 Siemens ProductCERT · Feb 24, 2026
- SUSE-SU-2025:03267-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:03268-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2023-2025-1351 Moderate: curl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jan 7, 2026
- NCSC-2025-0382 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Dec 9, 2025