CVE-2025-5399

What it actually does

A malicious WebSocket server can send a crafted packet that traps libcurl in an infinite busy-loop with no programmatic escape, forcing termination of the affected thread or process.

Why it matters to the business

Applications relying on libcurl for WebSocket connections can be rendered unresponsive, requiring manual intervention to recover and potentially causing service outages or degraded availability for dependent systems.

How an attack unfolds

An attacker hosts a malicious WebSocket server and waits for a vulnerable libcurl-based client to connect; once connected the server transmits a specially crafted packet that triggers the loop condition, locking the client process until it is killed.

How to fix it

Upgrade libcurl to a fixed version such as commit fdb8a789d2b446b77bd7cdd2eff95f6cbc814cf4 or apply the corresponding Ubuntu package updates for libice on the listed releases (2:1.0.9-1ubuntu0.16.04.1+esm1 or 2:1.0.9-2ubuntu0.18.04.1). Rebuild and redeploy any statically linked applications after updating the library.

How to confirm the fix worked

Confirm the installed libcurl version is at or above the fixed commit or package revision, then test WebSocket functionality against a server that previously triggered the loop to verify normal operation and exit behavior.

Typical attack path

1. Attacker deploys a WebSocket server that responds with a maliciously formatted packet
2. Victim application using libcurl initiates a WebSocket connection to the attacker-controlled endpoint
3. Server sends the crafted packet during the WebSocket handshake or data exchange
4. libcurl enters an endless busy-loop and ceases to process further requests or respond
5. Application becomes unresponsive until the process or thread is externally terminated

How to detect it

Look for curl or application processes consuming 100% CPU while performing WebSocket operations with no progress in logs; correlate with outbound connections to unexpected WebSocket endpoints and absence of normal data transfer after connection establishment.

What your security team should do

• Prioritize patching libcurl in all environments that perform WebSocket operations
• Inventory applications statically or dynamically linking libcurl and schedule upgrades
• Monitor for high-CPU processes involving libcurl or curl during WebSocket usage as a temporary detection signal
• Apply network-level controls to restrict outbound WebSocket connections to trusted endpoints until patches are deployed