CVE-2025-5399

mediumpriority · track · 0EPSS 0.014 · 72 %ileDEEUNLRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.38% (72nd) EPSS

CVSS 4.8 · medium

Is it mine?

108 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS libcurl-using application.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.8–7.5

v3.14.8mediumAV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:Lsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondaryexploitability 3.9 · impact 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-835USprimaryCWE-835USCWE-835US

affected products (108)

Products and version ranges known to be affected.

IBM Security Guardiumall versionscert_bundDEcpe:/a:ibm:security_guardium:-
Open Source Arch Linuxall versionscert_bundDEcpe:/o:archlinux:archlinux:-
Oracle Communications Applications 15.0.0.0.0all versionscert_bundDEcpe:/a:oracle:communications_applications:15.0.0.0.0
Oracle Communications Applications 15.0.1.0.0all versionscert_bundDEcpe:/a:oracle:communications_applications:15.0.1.0.0
Oracle Communications Applications 15.1.0.0.0all versionscert_bundDEcpe:/a:oracle:communications_applications:15.1.0.0.0
Oracle Communications Applications 2.0.0.0.0all versionscert_bundDEcpe:/a:oracle:communications_applications:2.0.0.0.0
Oracle Communications Applications 2.0.0.1.0all versionscert_bundDEcpe:/a:oracle:communications_applications:2.0.0.1.0
Oracle Communications Applications 3.0.3.3.0all versionscert_bundDEcpe:/a:oracle:communications_applications:3.0.3.3.0
Oracle Communications Applications 3.0.3.4.0all versionscert_bundDEcpe:/a:oracle:communications_applications:3.0.3.4.0
Oracle Communications Applications 6.1.1all versionscert_bundDEcpe:/a:oracle:communications_applications:6.1.1
Oracle Communications Applications 7.3.6all versionscert_bundDEcpe:/a:oracle:communications_applications:7.3.6
Oracle Communications Applications 7.4.0all versionscert_bundDEcpe:/a:oracle:communications_applications:7.4.0
Oracle Communications Applications 7.4.1all versionscert_bundDEcpe:/a:oracle:communications_applications:7.4.1
Oracle Communications Applications 7.5.0all versionscert_bundDEcpe:/a:oracle:communications_applications:7.5.0
Oracle Communications Applications 7.5.1all versionscert_bundDEcpe:/a:oracle:communications_applications:7.5.1
Oracle Communications Applications 7.7.0all versionscert_bundDEcpe:/a:oracle:communications_applications:7.7.0
Oracle Communications Applications 7.8.0all versionscert_bundDEcpe:/a:oracle:communications_applications:7.8.0
Oracle Communications Applications 8.0.0.5.0all versionscert_bundDEcpe:/a:oracle:communications_applications:8.0.0.5.0
Oracle Communications Applications 8.0.0.9.0all versionscert_bundDEcpe:/a:oracle:communications_applications:8.0.0.9.0
Oracle Communications Applications 8.1.0.28all versionscert_bundDEcpe:/a:oracle:communications_applications:8.1.0.28

showing 20 of 108

advisories (7)

Vendor and ecosystem advisories describing this.

NCSC-2025-0330Kwetsbaarheden verholpen in Oracle Communications productenNL2025-10-23csaf · ncsc_nlNL
Oracle heeft meerdere kwetsbaarheden verholpen in zijn Communications producten, waaronder de Unified Assurance en Cloud Native Core.
NCSC-2025-0339Kwetsbaarheden verholpen in Oracle MySQLNL2025-10-23csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in Oracle MySQL (Specifiek voor versies 8.0.0-8.0.43, 8.4.0-8.4.6, en 9.0.0-9.4.0).
WID-SEC-W-2025-1228cURL: Schwachstelle ermöglicht Denial of ServiceDeutsch2025-06-03csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in cURL ausnutzen, um einen Denial of Service Angriff durchzuführen.
WID-SEC-W-2025-1567Oracle MySQL: Mehrere SchwachstellenDeutsch2025-07-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2025-2360Oracle Communications Applications: Mehrere SchwachstellenDeutsch2025-10-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2025-2363Oracle MySQL: Mehrere SchwachstellenDeutsch2025-10-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
CURL-CVE-2025-5399WebSocket endless loop2025-06-04vendor · osvUS
Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS libcurl-using application.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund ncsc_nl osv NVD CVE.org MITRE

published 2025-06-07modified 2026-06-17

related (1,374)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2024-20353US	high8.6OT critical	69.8% (99th)	KEV	2024-04-24
A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthen…
CVE-2020-13935US	high7.5	86.6% (100th)	Exploit	2020-07-14
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payl…
CVE-2014-0050US	high7.5	83.3% (100th)	Exploit	2014-04-01
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infin…
CVE-2021-21341US	high7.5	77.8% (100th)	Exploit	2021-03-23
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CP…
CVE-2022-0778US	high7.5	73.2% (99th)	Exploit	2022-03-15
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsi…

+1369 more

references (14)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan