CVE-2025-10148

The curl tool is vulnerable to a predictable WebSocket mask due to a flaw where the WebSocket code fails to update the 32-bit mask pattern for each new outgoing frame, using a fixed mask instead. This allows a malicious server to induce traffic that an involved proxy might interpret as genuine HT...