Infinite loop in cURL - CVE-2025-5399

Vulnerability identifier: #VU110191

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-5399

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the WebSocket code. A malicious web server can send a specially crafted packet to the libcurl application and perform a denial of service (DoS) attack.

cURL
Arch Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Basesystem Module
openSUSE Leap
Tenable Identity Exposure (formerly Tenable.ad)
EasyApache
Communications Unified Assurance
MySQL Server
MySQL Cluster
MySQL Enterprise Backup
IBM Cloud Pak for Multicloud Management
mysql-selinux (Red Hat package)
mysql8.4 (Red Hat package)
curl
libcurl-devel-doc
libcurl4-64bit
libcurl-devel-64bit
libcurl4-64bit-debuginfo
libcurl4-32bit
libcurl-devel-32bit
libcurl4-32bit-debuginfo
curl-fish-completion
curl-zsh-completion
curl-debugsource
curl-debuginfo
curl-mini-debugsource
libcurl4
libcurl-mini4-debuginfo
libcurl-devel
libcurl4-debuginfo
libcurl-mini4
Guardium Data Protection

Install updates from vendor's website.

cURL - update to 8.14.1
Tenable Identity Exposure (formerly Tenable.ad) - update to 3.77.12
EasyApache - update to 4 25-19
MySQL Cluster - update to 8.4.7
mysql-selinux (Red Hat package) - update to 1.0.14-1.el10_0
IBM Cloud Pak for Multicloud Management - update to 2.3 Fix Pack 12
mysql8.4 (Red Hat package) - update to 8.4.6-2.el10_0
curl - update to 8.14.1-1
libcurl-devel-doc - update to 8.14.1-150600.4.28.1
libcurl4-64bit - update to 8.14.1-150600.4.28.1
libcurl-devel-64bit - update to 8.14.1-150600.4.28.1
libcurl4-64bit-debuginfo - update to 8.14.1-150600.4.28.1
libcurl4-32bit - update to 8.14.1-150600.4.28.1
libcurl-devel-32bit - update to 8.14.1-150600.4.28.1
libcurl4-32bit-debuginfo - update to 8.14.1-150600.4.28.1
curl-fish-completion - update to 8.14.1-150600.4.28.1
curl-zsh-completion - update to 8.14.1-150600.4.28.1
curl-debugsource - update to 8.14.1-150600.4.28.1
curl-debuginfo - update to 8.14.1-150600.4.28.1
curl - update to 8.14.1-150600.4.28.1
curl-mini-debugsource - update to 8.14.1-150600.4.28.1
libcurl4 - update to 8.14.1-150600.4.28.1
libcurl-mini4-debuginfo - update to 8.14.1-150600.4.28.1
libcurl-devel - update to 8.14.1-150600.4.28.1
libcurl4-debuginfo - update to 8.14.1-150600.4.28.1
libcurl-mini4 - update to 8.14.1-150600.4.28.1
Guardium Data Protection - update to 11.0p575

• https://curl.se/docs/CVE-2025-5399.html

• Denial of service in cURL
• Arch Linux update for curl
• cPanel EasyApache4 update for cURL
• Multiple vulnerabilities in MySQL Server
• Multiple vulnerabilities in Tenable Identity Exposure
• SUSE update for curl
• Red Hat Enterprise Linux 9 update for the mysql:8.4 module
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in MySQL Cluster
• Infinite loop in MySQL Enterprise Backup
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• Red Hat Enterprise Linux 10 update for multiple packages
• Multiple vulnerabilities in IBM Guardium Data Protection