What is CVE-2025-5399?

CVE-2025-5399 is a high-severity vulnerability in Curl, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 7.5/10. Published 2025-06-07.

How severe is CVE-2025-5399?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2025-5399 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Curl

CVE-2025-5399

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS libcurl-using application.

EPSS: 0.013 (67.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Curl — versions 8.14.0, 8.13.0
Haxx Curl

Weakness classification (CWE)

CWE-835 — Loop with Unreachable Exit Condition (Infinite Loop)

Public proof-of-concept exploits

References

2499f714-1537-4658-8207-48ae4bb9eae9 (Vendor Advisory)
2499f714-1537-4658-8207-48ae4bb9eae9 (Vendor Advisory)
2499f714-1537-4658-8207-48ae4bb9eae9 (Exploit, Third Party Advisory, Issue Tracking)
af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2025-5399?: CVE-2025-5399 is a high-severity vulnerability in Curl, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 7.5/10. Published 2025-06-07.
How severe is CVE-2025-5399?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2025-5399 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.