Curl CVE-2025-5399

This vulnerability presents HIGH real-world risk despite being network-dependent: (1) CVSS 7.5 reflects high severity with AV:N (network-accessible), AC:L (low attack complexity), PR:N (no privileges required), and A:H (high availability impact); (2) The attack vector is trivial—any application connecting to a WebSocket server can be exploited if that server is compromised or attacker-controlled; (3) CWE-835 busy-loop conditions are reliably exploitable and likely have POC implementations; (4) The impact is guaranteed DoS with no graceful recovery (thread/process kill required), affecting application availability directly; (5) Affected applications include: chat clients, real-time collaboration tools, IoT platforms, monitoring dashboards, and any service using libcurl for WebSocket communication. However, exploitation requires either a compromised legitimate server or MITM position if not using TLS, slightly limiting attack surface in some scenarios. The lack of authentication requirement (PR:N) and low complexity make this highly concerning for production systems.

Scenario 1 (Direct Attack): An attacker compromises a legitimate WebSocket service or sets up a malicious WebSocket endpoint. When a libcurl-based application (e.g., a chat client, monitoring dashboard, or IoT device) connects to this endpoint, the attacker sends a specially crafted WebSocket frame designed to trigger the busy-loop condition. The application's thread handling that connection enters an infinite loop, consuming 100% CPU and becoming unresponsive. The application must be restarted to recover. Scenario 2 (Supply Chain/MITM): An attacker positioned on the network path (compromised network, evil WiFi, BGP hijacking) intercepts WebSocket traffic and injects a malicious frame during the handshake or mid-connection. Same result: busy-loop DoS. Scenario 3 (Multiplied Impact): An IoT platform or SaaS backend using libcurl to proxy WebSocket connections is attacked, causing worker thread exhaustion as each connection that receives the malicious packet hangs indefinitely. Service-wide denial occurs when all worker threads are blocked. Attack complexity is LOW (AC:L)—the crafted packet likely has a simple, deterministic structure requiring no special conditions.