Description
Due to a mistake in libcurl's WebSocket code, a malicious server can send a
particularly crafted packet which makes libcurl get trapped in an endless
busy-loop.
There is no other way for the application to escape or exit this loop other
than killing the thread/process.
This might be used to DoS libcurl-using application.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| curl | curl | 8.14.0 – ≤ 8.14.0, 8.13.0 – ≤ 8.13.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 8.14.1-1 | — |
| Debian 13 | curl | 8.14.1-1 | — |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | mysql-selinux | 1.0.14-1.el10_0 | ALSA-2025:15699 |
| AlmaLinux 10 | mysql8.4-common +2 | 8.4.6-2.el10_0 | ALSA-2025:15699 |
| AlmaLinux 9 | mecab +1 | 0.996-3.module_el9.6.0+152+8cbce00c.4 | ALSA-2025:16046 |
| AlmaLinux 9 | mecab-ipadic +1 | 2.7.0.20070801-24.module_el9.6.0+152+8cbce00c | ALSA-2025:16046 |
| AlmaLinux 9 | mysql +7 | 8.4.6-1.module_el9.6.0+180+a4e757e5 | ALSA-2025:16046 |
| AlmaLinux 9 | rapidjson-doc +1 | 1.1.0-19.module_el9.6.0+152+8cbce00c | ALSA-2025:16046 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | mysql-selinux | 1.0.14-1.el10_0 | RLSA-2025:15699 |
| Rocky Linux 10 | mysql8.4 | 8.4.6-2.el10_0 | RLSA-2025:15699 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | curl | 8.14.1-150600.4.28.1 | SUSE-SU-2025:03198-1 |
| SLES 15 SP6 | curl | 8.14.1-150600.4.28.1 | SUSE-SU-2025:03198-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | curl | 8.14.1-slfo.1.1_1.1 | SUSE-SU-2025:20675-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | curl | 8.14.1-4.1 | openSUSE-SU-2025:15213-1 |
| openSUSE Leap 15.6 | curl | 8.14.1-150600.4.28.1 | SUSE-SU-2025:03198-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | curl | 8.14.1-r0 | — |
| Alpine v3.23 | curl | 8.14.1-r0 | — |
| Alpine v3.22 | curl | 8.14.1-r0 | — |
| Alpine v3.21 | curl | 8.14.1-r0 | — |
| Alpine v3.20 | curl | 8.14.1-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | curl | 8.14.1-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | mysql-selinux | 1.0.14-1.el10_0 | ELSA-2025-15699 |
| Oracle Linux 10 | mysql8.4 +7 | 8.4.6-2.el10_0 | ELSA-2025-15699 |
| Oracle Linux 9 | mecab +1 | 0.996-3.module+el9.6.0+90535+0c73839a.4 | ELSA-2025-16046 |
| Oracle Linux 9 | mecab-ipadic +1 | 2.7.0.20070801-24.0.1.module+el9.6.0+90535+0c73839a | ELSA-2025-16046 |
| Oracle Linux 9 | mysql +7 | 8.4.6-1.module+el9.6.0+90673+e6b08fe8 | ELSA-2025-16046 |
| Oracle Linux 9 | rapidjson-doc +1 | 1.1.0-19.module+el9.6.0+90535+0c73839a | ELSA-2025-16046 |
Advisories 14
- ALSA-2025:16046 Moderate: mysql:8.4 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:15699 Moderate: mysql-selinux and mysql8.4 security update AlmaLinux Security Advisories · Oct 29, 2026
- openSUSE-SU-2025:15213-1 curl-8.14.1-4.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:03198-1 Security update for curl SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20675-1 Security update for curl SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-2363 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 3, 2026
- WID-SEC-2025-1567 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2025-2360 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 17, 2025
- WID-SEC-2025-1228 cURL: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 4, 2025
- NCSC-2025-0339 Kwetsbaarheden verholpen in Oracle MySQL NCSC-NL (Netherlands) · Oct 23, 2025
- NCSC-2025-0330 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Oct 23, 2025
- RLSA-2025:15699 Moderate: mysql-selinux and mysql8.4 security update Rocky Linux Security Advisories · Oct 8, 2025
- ELSA-2025-16046 Moderate: mysql:8.4 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 17, 2025
- ELSA-2025-15699 Moderate: mysql-selinux and mysql8.4 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Sep 11, 2025