# CVE-2025-5399: curl: Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes l...

CVE-2025-5399 is fixed in 24 products on 1 platform, first by DEBIAN-CVE-2025-5399, released June 7, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2025-5399
- Priority: High
- CVSS: 7.5 (high)
- EPSS: 0.0144
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 7, 2025

## Description

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.  There is no other way for the application to escape or exit this loop other than killing the thread/process.  This might be used to DoS libcurl-using application.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | curl Debian 13.5 (trixie) | 8.14.1-1 | [DEBIAN-CVE-2025-5399](https://patchblox.com/security/data/fix/linux/debian-cve-2025-5399.md) | Jun 7, 2025 |
| Linux | curl Debian 14 | 8.14.1-1 | [DEBIAN-CVE-2025-5399](https://patchblox.com/security/data/fix/linux/debian-cve-2025-5399.md) | Jun 7, 2025 |
| Linux | curl opensuse-leap 15.6 | 8.14.1-150600.4.28.1 | [SUSE-SU-2025:03198-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03198-1.md) | Sep 12, 2025 |
| Linux | curl sles 15.6 | 8.14.1-150600.4.28.1 | [SUSE-SU-2025:03198-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03198-1.md) | Sep 12, 2025 |
| Linux | curl sles 15.7 | 8.14.1-150600.4.28.1 | [SUSE-SU-2025:03198-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03198-1.md) | Sep 12, 2025 |
| Linux | mecab almalinux 9 | 0.996-3.module_el9.6.0+152+8cbce00c.4 | [ALSA-2025:16046](https://patchblox.com/security/data/fix/linux/alsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mecab ol 9 | 0:0.996-3.module+el9.6.0+90535+0c73839a.4 | [ELSA-2025-16046](https://patchblox.com/security/data/fix/linux/elsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mecab-devel almalinux 9 | 0.996-3.module_el9.6.0+152+8cbce00c.4 | [ALSA-2025:16046](https://patchblox.com/security/data/fix/linux/alsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mecab-devel ol 9 | 0:0.996-3.module+el9.6.0+90535+0c73839a.4 | [ELSA-2025-16046](https://patchblox.com/security/data/fix/linux/elsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mecab-ipadic almalinux 9 | 2.7.0.20070801-24.module_el9.6.0+152+8cbce00c | [ALSA-2025:16046](https://patchblox.com/security/data/fix/linux/alsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mecab-ipadic ol 9 | 0:2.7.0.20070801-24.0.1.module+el9.6.0+90535+0c73839a | [ELSA-2025-16046](https://patchblox.com/security/data/fix/linux/elsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mecab-ipadic-EUCJP almalinux 9 | 2.7.0.20070801-24.module_el9.6.0+152+8cbce00c | [ALSA-2025:16046](https://patchblox.com/security/data/fix/linux/alsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mecab-ipadic-EUCJP ol 9 | 0:2.7.0.20070801-24.0.1.module+el9.6.0+90535+0c73839a | [ELSA-2025-16046](https://patchblox.com/security/data/fix/linux/elsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mysql almalinux 9 | 8.4.6-1.module_el9.6.0+180+a4e757e5 | [ALSA-2025:16046](https://patchblox.com/security/data/fix/linux/alsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mysql ol 9 | 0:8.4.6-1.module+el9.6.0+90673+e6b08fe8 | [ELSA-2025-16046](https://patchblox.com/security/data/fix/linux/elsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mysql-common almalinux 9 | 8.4.6-1.module_el9.6.0+180+a4e757e5 | [ALSA-2025:16046](https://patchblox.com/security/data/fix/linux/alsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mysql-common ol 9 | 0:8.4.6-1.module+el9.6.0+90673+e6b08fe8 | [ELSA-2025-16046](https://patchblox.com/security/data/fix/linux/elsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mysql-devel almalinux 9 | 8.4.6-1.module_el9.6.0+180+a4e757e5 | [ALSA-2025:16046](https://patchblox.com/security/data/fix/linux/alsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mysql-devel ol 9 | 0:8.4.6-1.module+el9.6.0+90673+e6b08fe8 | [ELSA-2025-16046](https://patchblox.com/security/data/fix/linux/elsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mysql-errmsg almalinux 9 | 8.4.6-1.module_el9.6.0+180+a4e757e5 | [ALSA-2025:16046](https://patchblox.com/security/data/fix/linux/alsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mysql-errmsg ol 9 | 0:8.4.6-1.module+el9.6.0+90673+e6b08fe8 | [ELSA-2025-16046](https://patchblox.com/security/data/fix/linux/elsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mysql-libs almalinux 9 | 8.4.6-1.module_el9.6.0+180+a4e757e5 | [ALSA-2025:16046](https://patchblox.com/security/data/fix/linux/alsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mysql-libs ol 9 | 0:8.4.6-1.module+el9.6.0+90673+e6b08fe8 | [ELSA-2025-16046](https://patchblox.com/security/data/fix/linux/elsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mysql-selinux almalinux 10 | 1.0.14-1.el10_0 | [ALSA-2025:15699](https://patchblox.com/security/data/fix/linux/alsa-2025-15699.md) | Sep 11, 2025 |
| Linux | mysql-selinux ol 10 | 0:1.0.14-1.el10_0 | [ELSA-2025-15699](https://patchblox.com/security/data/fix/linux/elsa-2025-15699.md) | Sep 11, 2025 |
| Linux | mysql-selinux rocky 10 | 0:1.0.14-1.el10_0 | [RLSA-2025:15699](https://patchblox.com/security/data/fix/linux/rlsa-2025-15699.md) | Oct 3, 2025 |
| Linux | mysql-server almalinux 9 | 8.4.6-1.module_el9.6.0+180+a4e757e5 | [ALSA-2025:16046](https://patchblox.com/security/data/fix/linux/alsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mysql-server ol 9 | 0:8.4.6-1.module+el9.6.0+90673+e6b08fe8 | [ELSA-2025-16046](https://patchblox.com/security/data/fix/linux/elsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mysql-test almalinux 9 | 8.4.6-1.module_el9.6.0+180+a4e757e5 | [ALSA-2025:16046](https://patchblox.com/security/data/fix/linux/alsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mysql-test ol 9 | 0:8.4.6-1.module+el9.6.0+90673+e6b08fe8 | [ELSA-2025-16046](https://patchblox.com/security/data/fix/linux/elsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mysql-test-data almalinux 9 | 8.4.6-1.module_el9.6.0+180+a4e757e5 | [ALSA-2025:16046](https://patchblox.com/security/data/fix/linux/alsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mysql-test-data ol 9 | 0:8.4.6-1.module+el9.6.0+90673+e6b08fe8 | [ELSA-2025-16046](https://patchblox.com/security/data/fix/linux/elsa-2025-16046.md) | Sep 17, 2025 |
| Linux | mysql8.4 ol 10 | 0:8.4.6-2.el10_0 | [ELSA-2025-15699](https://patchblox.com/security/data/fix/linux/elsa-2025-15699.md) | Sep 11, 2025 |
| Linux | mysql8.4 rocky 10 | 0:8.4.6-2.el10_0 | [RLSA-2025:15699](https://patchblox.com/security/data/fix/linux/rlsa-2025-15699.md) | Oct 3, 2025 |
| Linux | mysql8.4-common almalinux 10 | 8.4.6-2.el10_0 | [ALSA-2025:15699](https://patchblox.com/security/data/fix/linux/alsa-2025-15699.md) | Sep 11, 2025 |
| Linux | mysql8.4-common ol 10 | 0:8.4.6-2.el10_0 | [ELSA-2025-15699](https://patchblox.com/security/data/fix/linux/elsa-2025-15699.md) | Sep 11, 2025 |
| Linux | mysql8.4-devel ol 10 | 0:8.4.6-2.el10_0 | [ELSA-2025-15699](https://patchblox.com/security/data/fix/linux/elsa-2025-15699.md) | Sep 11, 2025 |
| Linux | mysql8.4-errmsg almalinux 10 | 8.4.6-2.el10_0 | [ALSA-2025:15699](https://patchblox.com/security/data/fix/linux/alsa-2025-15699.md) | Sep 11, 2025 |
| Linux | mysql8.4-errmsg ol 10 | 0:8.4.6-2.el10_0 | [ELSA-2025-15699](https://patchblox.com/security/data/fix/linux/elsa-2025-15699.md) | Sep 11, 2025 |
| Linux | mysql8.4-libs ol 10 | 0:8.4.6-2.el10_0 | [ELSA-2025-15699](https://patchblox.com/security/data/fix/linux/elsa-2025-15699.md) | Sep 11, 2025 |
| Linux | mysql8.4-server ol 10 | 0:8.4.6-2.el10_0 | [ELSA-2025-15699](https://patchblox.com/security/data/fix/linux/elsa-2025-15699.md) | Sep 11, 2025 |
| Linux | mysql8.4-test ol 10 | 0:8.4.6-2.el10_0 | [ELSA-2025-15699](https://patchblox.com/security/data/fix/linux/elsa-2025-15699.md) | Sep 11, 2025 |
| Linux | mysql8.4-test-data almalinux 10 | 8.4.6-2.el10_0 | [ALSA-2025:15699](https://patchblox.com/security/data/fix/linux/alsa-2025-15699.md) | Sep 11, 2025 |
| Linux | mysql8.4-test-data ol 10 | 0:8.4.6-2.el10_0 | [ELSA-2025-15699](https://patchblox.com/security/data/fix/linux/elsa-2025-15699.md) | Sep 11, 2025 |
| Linux | rapidjson-devel almalinux 9 | 1.1.0-19.module_el9.6.0+152+8cbce00c | [ALSA-2025:16046](https://patchblox.com/security/data/fix/linux/alsa-2025-16046.md) | Sep 17, 2025 |
| Linux | rapidjson-devel ol 9 | 0:1.1.0-19.module+el9.6.0+90535+0c73839a | [ELSA-2025-16046](https://patchblox.com/security/data/fix/linux/elsa-2025-16046.md) | Sep 17, 2025 |
| Linux | rapidjson-doc almalinux 9 | 1.1.0-19.module_el9.6.0+152+8cbce00c | [ALSA-2025:16046](https://patchblox.com/security/data/fix/linux/alsa-2025-16046.md) | Sep 17, 2025 |
| Linux | rapidjson-doc ol 9 | 0:1.1.0-19.module+el9.6.0+90535+0c73839a | [ELSA-2025-16046](https://patchblox.com/security/data/fix/linux/elsa-2025-16046.md) | Sep 17, 2025 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.