Curl CVE-2025-5399

Immediate actions: (1) Upgrade libcurl to patched version once released (typically announced at curl.se security advisories—patch version number pending, monitor releases post-CVE disclosure); (2) For critical systems, implement network segmentation to restrict WebSocket connections to trusted servers only; (3) Disable WebSocket support in libcurl at compile time if not required (./configure --without-websockets or similar); (4) Implement connection timeouts in calling application code to force disconnection if no data received within expected timeframe (workaround, not fix). Long-term: (1) Subscribe to curl security mailing list for patch notifications; (2) Implement automated patching for libcurl dependencies across all systems; (3) Monitor for indicators of exploitation (thread/process crashes correlated with WebSocket connections); (4) Use TLS for WebSocket connections (wss://) to reduce MITM attack surface, though this does not prevent compromised server attacks.