CVE-2025-10148
Publication date 10 September 2025
Last updated 15 September 2025
Ubuntu priority
predictable WebSocket mask
Read the notes from the security team
Why is this CVE low priority?
Curl developers have rated this as being low severity
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| curl | 25.04 plucky |
Vulnerable
|
| 24.04 LTS noble |
Vulnerable
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty |
Not affected
|
Notes
ebarretto
WebSocket was considered experimental before 8.11.0 and only enabled in build since 8.8.0-2
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
5.3 · Medium
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | Low |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |