Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-5399
CVE-2025-5399:
cURL vulnerability analysis and mitigation
Overview
A vulnerability in libcurl's WebSocket code (CVE-2025-5399) was discovered that allows a malicious server to trigger an endless busy-loop condition. The vulnerability affects curl versions 8.13.0 through 8.14.0, and was discovered on May 30, 2025. This low-severity issue is classified as CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') (Curl Advisory, OSS Security).
Technical details
The vulnerability occurs in libcurl's WebSocket implementation when processing certain crafted packets from a malicious server. The issue specifically relates to the auto-pong functionality and can be avoided if the 'auto-pong' feature is disabled using the CURLWS_NOAUTOPONG option. The flaw does not affect the curl command line tool and is not considered a C language-specific mistake (Curl Advisory).
Impact
When exploited, this vulnerability can cause a denial of service (DoS) condition in libcurl-using applications. The affected application becomes trapped in an endless busy-loop, with no way to escape or exit other than forcibly terminating the thread or process (Curl Advisory).
Mitigation and workarounds
Three mitigation options are available: 1) Upgrade curl to version 8.14.1 which contains the fix, 2) Apply the patch to the local version (fixed in commit d1145df24de8f80e6b16), or 3) Avoid using WebSocket functionality. Additionally, users can disable the auto-pong feature using the CURLWS_NOAUTOPONG option as a temporary workaround (Curl Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management