Search
Search is not available in local development.
Run npx pagefind --site __site after building to enable it.
JLSEC-2026-434 High 7.5

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted...

SourceEditHistoryOSVJSON (OSV)
JLSEC Published
Modified
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Packages
CURL_jll >= 8.13.0+0, < 8.14.1+0
LibCURL_jll >= 8.13.0+0, < 8.14.1+0
Aliases / Upstream
CVE-2025-5399 GHSA-8h93-38hx-vv92 EUVD-2025-17371

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.

There is no other way for the application to escape or exit this loop other than killing the thread/process.

This might be used to DoS libcurl-using application.

References