CVE-2025-5399
WebSocket endless loop
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
WebSocket endless loop
Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS libcurl-using application.
Reserved 2025-05-31 | Published 2025-06-07 | Updated 2025-06-07 | Assigner curlCWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
z2_ on hackerone
z2_ on hackerone
curl.se/docs/CVE-2025-5399.json (json)
curl.se/docs/CVE-2025-5399.html (www)
hackerone.com/reports/3168039 (issue)
Support options
