CVE-2025-10148Medium· 5.3▾ Sunlitcurl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern al…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
0.5% → 0.5%
curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection.
A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.
curl >= 8.11.0, < 8.16.0Upgrade past the affected range:
curl 8.16.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86414Noneleaking host credentials to HTTP proxy
CVE-2026-86415Noneauto client cert connection reuse mixup
CVE-2026-87861Nonecross-origin reuse of a Negotiate connection
CVE-2026-87862NoneHSTS cache import drops longer-lived child
CVE-2026-86409Nonestale SigV4 headers sent unintended
CVE-2026-86410Noneredirect to SFTP or SCP bypasses host verification