Endless Loop Vulnerability in curl Package: CVE-2025-5399
Summary
ALPINE-CVE-2025-5399: Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. Affects curl versions < 8.14.1-r0. Fixed in 8.14.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curl package is a widely used command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, HTTPS, FTP, and more. curl is integral to many applications for its ability to facilitate data transfers and interactions with web services. However, it is susceptible to vulnerabilities that can compromise its functionality and the applications that rely on it.
Vulnerability Detail
The vulnerability identified as CVE-2025-5399 arises from a flaw in libcurl's WebSocket code. A malicious server can send a specially crafted packet that traps libcurl in an endless busy-loop. This condition prevents the application from escaping or exiting the loop, effectively leading to a denial-of-service (DoS) situation for any application utilizing libcurl. The only way to terminate this loop is to kill the thread or process, which can disrupt service and affect user experience.
How To Fix
Minimum fixed version
8.14.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to bypass this vulnerability without applying the patch. The best course of action is to update to the fixed version as mentioned above.
Conclusion
CVE-2025-5399 presents a significant risk to applications using the curl package due to its potential to cause denial-of-service conditions. It is crucial to update to the patched version 8.14.1-r0 to mitigate this risk. Regular monitoring and vulnerability assessments, such as those provided by Vulert, can help maintain the security of your applications.
See every vulnerability recorded for curl →
FAQ
CVE-2025-5399 is a vulnerability in the curl package that allows a malicious server to trap libcurl in an endless busy-loop, leading to a denial-of-service condition.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
The primary consequence is a denial-of-service condition, where applications using libcurl may become unresponsive due to the endless loop.
Yes, a patch is available in version 8.14.1-r0 of the curl package. Updating to this version will resolve the vulnerability.
If immediate updating is not possible, monitor your application closely for any signs of unresponsiveness and consider implementing temporary measures to limit exposure to potentially malicious servers.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
