CVE-2025-5399

A flaw was found in libcurl's WebSocket handling. This vulnerability allows a malicious server to cause an applicaiton level denial of service (DoS) by triggering an infinite busy-loop, effectively trapping the application thread, via a specially crafted WebSocket packet when "auto-pong" is enabled.

The severity of this vulnerability is rated Moderate, as it does not impact system availability. The effects are confined to the application layer, without compromising the underlying system stability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.