Vulnerability-Lookup

OPENSUSE-SU-2026:20031-1

Vulnerability from csaf_opensuse - Published: 2026-01-14 11:01 - Updated: 2026-09-15 16:13

Summary

Security update for curl

Severity

Moderate

Notes

Title of the patch: Security update for curl

Description of the patch: This update for curl fixes the following issues: This update for curl fixes the following issues: - CVE-2025-14017: broken TLS options for threaded LDAPS (bsc#1256105). - CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731). - CVE-2025-14819: libssh global knownhost override (bsc#1255732). - CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733). - CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

Patchnames: openSUSE-Leap-16.0-140

CVE-2025-14017

6.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected products

Recommended 15 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-14524

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 15 products, the same list as for CVE-2025-14017

Threats

Impact moderate

CVE-2025-14819

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 15 products, the same list as for CVE-2025-14017

Threats

Impact moderate

CVE-2025-15079

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 15 products, the same list as for CVE-2025-14017

Threats

Impact moderate

CVE-2025-15224

3.1 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected products

Recommended 15 products, the same list as for CVE-2025-14017

Threats

Impact moderate

References

22 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://bugzilla.suse.com/1255731	self
https://bugzilla.suse.com/1255732	self
https://bugzilla.suse.com/1255733	self
https://bugzilla.suse.com/1255734	self
https://bugzilla.suse.com/1256105	self
https://www.suse.com/security/cve/CVE-2025-14017/	self
https://www.suse.com/security/cve/CVE-2025-14524/	self
https://www.suse.com/security/cve/CVE-2025-14819/	self
https://www.suse.com/security/cve/CVE-2025-15079/	self
https://www.suse.com/security/cve/CVE-2025-15224/	self
https://www.suse.com/security/cve/CVE-2025-14017	external
https://bugzilla.suse.com/1256105	external
https://www.suse.com/security/cve/CVE-2025-14524	external
https://bugzilla.suse.com/1255731	external
https://www.suse.com/security/cve/CVE-2025-14819	external
https://bugzilla.suse.com/1255732	external
https://www.suse.com/security/cve/CVE-2025-15079	external
https://bugzilla.suse.com/1255733	external
https://www.suse.com/security/cve/CVE-2025-15224	external
https://bugzilla.suse.com/1255734	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for curl",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for curl fixes the following issues:\n\nThis update for curl fixes the following issues:\n\n- CVE-2025-14017: broken TLS options for threaded LDAPS (bsc#1256105).\n- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).\n- CVE-2025-14819: libssh global knownhost override (bsc#1255732).\n- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).\n- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-140",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20031-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255731",
        "url": "https://bugzilla.suse.com/1255731"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255732",
        "url": "https://bugzilla.suse.com/1255732"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255733",
        "url": "https://bugzilla.suse.com/1255733"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255734",
        "url": "https://bugzilla.suse.com/1255734"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256105",
        "url": "https://bugzilla.suse.com/1256105"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14017 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14017/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14524 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14524/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14819 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14819/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15079 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15079/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15224 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15224/"
      }
    ],
    "title": "Security update for curl",
    "tracking": {
      "current_release_date": "2026-09-15T16:13:07Z",
      "generator": {
        "date": "2026-01-14T11:01:44Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:20031-1",
      "initial_release_date": "2026-01-14T11:01:44Z",
      "revision_history": [
        {
          "date": "2026-01-14T11:01:44Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-15T16:13:07Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-160000.4.1.aarch64",
                "product": {
                  "name": "curl-8.14.1-160000.4.1.aarch64",
                  "product_id": "curl-8.14.1-160000.4.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-160000.4.1.aarch64",
                "product": {
                  "name": "libcurl-devel-8.14.1-160000.4.1.aarch64",
                  "product_id": "libcurl-devel-8.14.1-160000.4.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-160000.4.1.aarch64",
                "product": {
                  "name": "libcurl4-8.14.1-160000.4.1.aarch64",
                  "product_id": "libcurl4-8.14.1-160000.4.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-fish-completion-8.14.1-160000.4.1.noarch",
                "product": {
                  "name": "curl-fish-completion-8.14.1-160000.4.1.noarch",
                  "product_id": "curl-fish-completion-8.14.1-160000.4.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "curl-zsh-completion-8.14.1-160000.4.1.noarch",
                "product": {
                  "name": "curl-zsh-completion-8.14.1-160000.4.1.noarch",
                  "product_id": "curl-zsh-completion-8.14.1-160000.4.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-doc-8.14.1-160000.4.1.noarch",
                "product": {
                  "name": "libcurl-devel-doc-8.14.1-160000.4.1.noarch",
                  "product_id": "libcurl-devel-doc-8.14.1-160000.4.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-160000.4.1.ppc64le",
                "product": {
                  "name": "curl-8.14.1-160000.4.1.ppc64le",
                  "product_id": "curl-8.14.1-160000.4.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-160000.4.1.ppc64le",
                "product": {
                  "name": "libcurl-devel-8.14.1-160000.4.1.ppc64le",
                  "product_id": "libcurl-devel-8.14.1-160000.4.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-160000.4.1.ppc64le",
                "product": {
                  "name": "libcurl4-8.14.1-160000.4.1.ppc64le",
                  "product_id": "libcurl4-8.14.1-160000.4.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-160000.4.1.s390x",
                "product": {
                  "name": "curl-8.14.1-160000.4.1.s390x",
                  "product_id": "curl-8.14.1-160000.4.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-160000.4.1.s390x",
                "product": {
                  "name": "libcurl-devel-8.14.1-160000.4.1.s390x",
                  "product_id": "libcurl-devel-8.14.1-160000.4.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-160000.4.1.s390x",
                "product": {
                  "name": "libcurl4-8.14.1-160000.4.1.s390x",
                  "product_id": "libcurl4-8.14.1-160000.4.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-160000.4.1.x86_64",
                "product": {
                  "name": "curl-8.14.1-160000.4.1.x86_64",
                  "product_id": "curl-8.14.1-160000.4.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-160000.4.1.x86_64",
                "product": {
                  "name": "libcurl-devel-8.14.1-160000.4.1.x86_64",
                  "product_id": "libcurl-devel-8.14.1-160000.4.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-160000.4.1.x86_64",
                "product": {
                  "name": "libcurl4-8.14.1-160000.4.1.x86_64",
                  "product_id": "libcurl4-8.14.1-160000.4.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-160000.4.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64"
        },
        "product_reference": "curl-8.14.1-160000.4.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-160000.4.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le"
        },
        "product_reference": "curl-8.14.1-160000.4.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-160000.4.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x"
        },
        "product_reference": "curl-8.14.1-160000.4.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-160000.4.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64"
        },
        "product_reference": "curl-8.14.1-160000.4.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-fish-completion-8.14.1-160000.4.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch"
        },
        "product_reference": "curl-fish-completion-8.14.1-160000.4.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-zsh-completion-8.14.1-160000.4.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch"
        },
        "product_reference": "curl-zsh-completion-8.14.1-160000.4.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-160000.4.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64"
        },
        "product_reference": "libcurl-devel-8.14.1-160000.4.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-160000.4.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le"
        },
        "product_reference": "libcurl-devel-8.14.1-160000.4.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-160000.4.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x"
        },
        "product_reference": "libcurl-devel-8.14.1-160000.4.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-160000.4.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64"
        },
        "product_reference": "libcurl-devel-8.14.1-160000.4.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-doc-8.14.1-160000.4.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch"
        },
        "product_reference": "libcurl-devel-doc-8.14.1-160000.4.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-160000.4.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64"
        },
        "product_reference": "libcurl4-8.14.1-160000.4.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-160000.4.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le"
        },
        "product_reference": "libcurl4-8.14.1-160000.4.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-160000.4.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x"
        },
        "product_reference": "libcurl4-8.14.1-160000.4.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-160000.4.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
        },
        "product_reference": "libcurl4-8.14.1-160000.4.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14017",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14017"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
          "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
          "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
          "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
          "openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
          "openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
          "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
          "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
          "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
          "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
          "openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
          "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
          "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
          "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
          "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14017",
          "url": "https://www.suse.com/security/cve/CVE-2025-14017"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256105 for CVE-2025-14017",
          "url": "https://bugzilla.suse.com/1256105"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
            "openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
            "openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-14T11:01:44Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14017"
    },
    {
      "cve": "CVE-2025-14524",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14524"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
          "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
          "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
          "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
          "openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
          "openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
          "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
          "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
          "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
          "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
          "openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
          "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
          "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
          "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
          "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14524",
          "url": "https://www.suse.com/security/cve/CVE-2025-14524"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255731 for CVE-2025-14524",
          "url": "https://bugzilla.suse.com/1255731"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
            "openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
            "openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-14T11:01:44Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14524"
    },
    {
      "cve": "CVE-2025-14819",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14819"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing TLS related transfers with reused easy or multi handles and\naltering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user\u0027s wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
          "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
          "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
          "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
          "openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
          "openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
          "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
          "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
          "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
          "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
          "openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
          "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
          "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
          "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
          "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14819",
          "url": "https://www.suse.com/security/cve/CVE-2025-14819"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255732 for CVE-2025-14819",
          "url": "https://bugzilla.suse.com/1255732"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
            "openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
            "openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-14T11:01:44Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14819"
    },
    {
      "cve": "CVE-2025-15079",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15079"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
          "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
          "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
          "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
          "openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
          "openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
          "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
          "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
          "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
          "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
          "openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
          "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
          "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
          "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
          "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15079",
          "url": "https://www.suse.com/security/cve/CVE-2025-15079"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255733 for CVE-2025-15079",
          "url": "https://bugzilla.suse.com/1255733"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
            "openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
            "openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-14T11:01:44Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15079"
    },
    {
      "cve": "CVE-2025-15224",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15224"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
          "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
          "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
          "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
          "openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
          "openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
          "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
          "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
          "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
          "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
          "openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
          "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
          "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
          "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
          "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15224",
          "url": "https://www.suse.com/security/cve/CVE-2025-15224"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255734 for CVE-2025-15224",
          "url": "https://bugzilla.suse.com/1255734"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
            "openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
            "openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
            "openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
            "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-14T11:01:44Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15224"
    }
  ]
}

CVE-2025-14017 (GCVE-0-2025-14017)

Vulnerability from cvelistv5 – Published: 2026-01-08 10:07 – Updated: 2026-09-15 06:02

Title

broken TLS options for threaded LDAPS

Summary

When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-29 00:00 UTC

CWE

CWE-567 - Unsynchronized Access to Shared Data in a Multi-threaded Context

Assigner

curl redhat root

References

3 references

URL	Tags
https://curl.se/docs/CVE-2025-14017.json
https://curl.se/docs/CVE-2025-14017.html
http://www.openwall.com/lists/oss-security/2026/01/07/3

Impacted products

3 products

Vendor	Product	Version
curl	curl	Affected: 7.17.0 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.18.0 (semver)
curl	curl	Affected: ccba0d10b6baf5c73cae8cf4fb3f29f0f55c5a34 , < 39d1976b7f709a516e3243338ebc0443bdd8d56d (git)
curl	curl	Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0 Affected: 7.70.0 Affected: 7.69.1 Affected: 7.69.0 Affected: 7.68.0 Affected: 7.67.0 Affected: 7.66.0 Affected: 7.65.3 Affected: 7.65.2 Affected: 7.65.1 Affected: 7.65.0 Affected: 7.64.1 Affected: 7.64.0 Affected: 7.63.0 Affected: 7.62.0 Affected: 7.61.1 Affected: 7.61.0 Affected: 7.60.0 Affected: 7.59.0 Affected: 7.58.0 Affected: 7.57.0 Affected: 7.56.1 Affected: 7.56.0 Affected: 7.55.1 Affected: 7.55.0 Affected: 7.54.1 Affected: 7.54.0 Affected: 7.53.1 Affected: 7.53.0 Affected: 7.52.1 Affected: 7.52.0 Affected: 7.51.0 Affected: 7.50.3 Affected: 7.50.2 Affected: 7.50.1 Affected: 7.50.0 Affected: 7.49.1 Affected: 7.49.0 Affected: 7.48.0 Affected: 7.47.1 Affected: 7.47.0 Affected: 7.46.0 Affected: 7.45.0 Affected: 7.44.0 Affected: 7.43.0 Affected: 7.42.1 Affected: 7.42.0 Affected: 7.41.0 Affected: 7.40.0 Affected: 7.39.0 Affected: 7.38.0 Affected: 7.37.1 Affected: 7.37.0 Affected: 7.36.0 Affected: 7.35.0 Affected: 7.34.0 Affected: 7.33.0 Affected: 7.32.0 Affected: 7.31.0 Affected: 7.30.0 Affected: 7.29.0 Affected: 7.28.1 Affected: 7.28.0 Affected: 7.27.0 Affected: 7.26.0 Affected: 7.25.0 Affected: 7.24.0 Affected: 7.23.1 Affected: 7.23.0 Affected: 7.22.0 Affected: 7.21.7 Affected: 7.21.6 Affected: 7.21.5 Affected: 7.21.4 Affected: 7.21.3 Affected: 7.21.2 Affected: 7.21.1 Affected: 7.21.0 Affected: 7.20.1 Affected: 7.20.0 Affected: 7.19.7 Affected: 7.19.6 Affected: 7.19.5 Affected: 7.19.4 Affected: 7.19.3 Affected: 7.19.2 Affected: 7.19.1 Affected: 7.19.0 Affected: 7.18.2 Affected: 7.18.1 Affected: 7.18.0 Affected: 7.17.1 Affected: 7.17.0

Credits

Stanislav Fort (Aisle Research) Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-08T11:05:58.081Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/07/3"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-14017",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-29T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-30T03:56:00.891Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "7.17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.18.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "39d1976b7f709a516e3243338ebc0443bdd8d56d",
              "status": "affected",
              "version": "ccba0d10b6baf5c73cae8cf4fb3f29f0f55c5a34",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            },
            {
              "status": "affected",
              "version": "8.7.1"
            },
            {
              "status": "affected",
              "version": "8.7.0"
            },
            {
              "status": "affected",
              "version": "8.6.0"
            },
            {
              "status": "affected",
              "version": "8.5.0"
            },
            {
              "status": "affected",
              "version": "8.4.0"
            },
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.2.1"
            },
            {
              "status": "affected",
              "version": "8.2.0"
            },
            {
              "status": "affected",
              "version": "8.1.2"
            },
            {
              "status": "affected",
              "version": "8.1.1"
            },
            {
              "status": "affected",
              "version": "8.1.0"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "7.88.1"
            },
            {
              "status": "affected",
              "version": "7.88.0"
            },
            {
              "status": "affected",
              "version": "7.87.0"
            },
            {
              "status": "affected",
              "version": "7.86.0"
            },
            {
              "status": "affected",
              "version": "7.85.0"
            },
            {
              "status": "affected",
              "version": "7.84.0"
            },
            {
              "status": "affected",
              "version": "7.83.1"
            },
            {
              "status": "affected",
              "version": "7.83.0"
            },
            {
              "status": "affected",
              "version": "7.82.0"
            },
            {
              "status": "affected",
              "version": "7.81.0"
            },
            {
              "status": "affected",
              "version": "7.80.0"
            },
            {
              "status": "affected",
              "version": "7.79.1"
            },
            {
              "status": "affected",
              "version": "7.79.0"
            },
            {
              "status": "affected",
              "version": "7.78.0"
            },
            {
              "status": "affected",
              "version": "7.77.0"
            },
            {
              "status": "affected",
              "version": "7.76.1"
            },
            {
              "status": "affected",
              "version": "7.76.0"
            },
            {
              "status": "affected",
              "version": "7.75.0"
            },
            {
              "status": "affected",
              "version": "7.74.0"
            },
            {
              "status": "affected",
              "version": "7.73.0"
            },
            {
              "status": "affected",
              "version": "7.72.0"
            },
            {
              "status": "affected",
              "version": "7.71.1"
            },
            {
              "status": "affected",
              "version": "7.71.0"
            },
            {
              "status": "affected",
              "version": "7.70.0"
            },
            {
              "status": "affected",
              "version": "7.69.1"
            },
            {
              "status": "affected",
              "version": "7.69.0"
            },
            {
              "status": "affected",
              "version": "7.68.0"
            },
            {
              "status": "affected",
              "version": "7.67.0"
            },
            {
              "status": "affected",
              "version": "7.66.0"
            },
            {
              "status": "affected",
              "version": "7.65.3"
            },
            {
              "status": "affected",
              "version": "7.65.2"
            },
            {
              "status": "affected",
              "version": "7.65.1"
            },
            {
              "status": "affected",
              "version": "7.65.0"
            },
            {
              "status": "affected",
              "version": "7.64.1"
            },
            {
              "status": "affected",
              "version": "7.64.0"
            },
            {
              "status": "affected",
              "version": "7.63.0"
            },
            {
              "status": "affected",
              "version": "7.62.0"
            },
            {
              "status": "affected",
              "version": "7.61.1"
            },
            {
              "status": "affected",
              "version": "7.61.0"
            },
            {
              "status": "affected",
              "version": "7.60.0"
            },
            {
              "status": "affected",
              "version": "7.59.0"
            },
            {
              "status": "affected",
              "version": "7.58.0"
            },
            {
              "status": "affected",
              "version": "7.57.0"
            },
            {
              "status": "affected",
              "version": "7.56.1"
            },
            {
              "status": "affected",
              "version": "7.56.0"
            },
            {
              "status": "affected",
              "version": "7.55.1"
            },
            {
              "status": "affected",
              "version": "7.55.0"
            },
            {
              "status": "affected",
              "version": "7.54.1"
            },
            {
              "status": "affected",
              "version": "7.54.0"
            },
            {
              "status": "affected",
              "version": "7.53.1"
            },
            {
              "status": "affected",
              "version": "7.53.0"
            },
            {
              "status": "affected",
              "version": "7.52.1"
            },
            {
              "status": "affected",
              "version": "7.52.0"
            },
            {
              "status": "affected",
              "version": "7.51.0"
            },
            {
              "status": "affected",
              "version": "7.50.3"
            },
            {
              "status": "affected",
              "version": "7.50.2"
            },
            {
              "status": "affected",
              "version": "7.50.1"
            },
            {
              "status": "affected",
              "version": "7.50.0"
            },
            {
              "status": "affected",
              "version": "7.49.1"
            },
            {
              "status": "affected",
              "version": "7.49.0"
            },
            {
              "status": "affected",
              "version": "7.48.0"
            },
            {
              "status": "affected",
              "version": "7.47.1"
            },
            {
              "status": "affected",
              "version": "7.47.0"
            },
            {
              "status": "affected",
              "version": "7.46.0"
            },
            {
              "status": "affected",
              "version": "7.45.0"
            },
            {
              "status": "affected",
              "version": "7.44.0"
            },
            {
              "status": "affected",
              "version": "7.43.0"
            },
            {
              "status": "affected",
              "version": "7.42.1"
            },
            {
              "status": "affected",
              "version": "7.42.0"
            },
            {
              "status": "affected",
              "version": "7.41.0"
            },
            {
              "status": "affected",
              "version": "7.40.0"
            },
            {
              "status": "affected",
              "version": "7.39.0"
            },
            {
              "status": "affected",
              "version": "7.38.0"
            },
            {
              "status": "affected",
              "version": "7.37.1"
            },
            {
              "status": "affected",
              "version": "7.37.0"
            },
            {
              "status": "affected",
              "version": "7.36.0"
            },
            {
              "status": "affected",
              "version": "7.35.0"
            },
            {
              "status": "affected",
              "version": "7.34.0"
            },
            {
              "status": "affected",
              "version": "7.33.0"
            },
            {
              "status": "affected",
              "version": "7.32.0"
            },
            {
              "status": "affected",
              "version": "7.31.0"
            },
            {
              "status": "affected",
              "version": "7.30.0"
            },
            {
              "status": "affected",
              "version": "7.29.0"
            },
            {
              "status": "affected",
              "version": "7.28.1"
            },
            {
              "status": "affected",
              "version": "7.28.0"
            },
            {
              "status": "affected",
              "version": "7.27.0"
            },
            {
              "status": "affected",
              "version": "7.26.0"
            },
            {
              "status": "affected",
              "version": "7.25.0"
            },
            {
              "status": "affected",
              "version": "7.24.0"
            },
            {
              "status": "affected",
              "version": "7.23.1"
            },
            {
              "status": "affected",
              "version": "7.23.0"
            },
            {
              "status": "affected",
              "version": "7.22.0"
            },
            {
              "status": "affected",
              "version": "7.21.7"
            },
            {
              "status": "affected",
              "version": "7.21.6"
            },
            {
              "status": "affected",
              "version": "7.21.5"
            },
            {
              "status": "affected",
              "version": "7.21.4"
            },
            {
              "status": "affected",
              "version": "7.21.3"
            },
            {
              "status": "affected",
              "version": "7.21.2"
            },
            {
              "status": "affected",
              "version": "7.21.1"
            },
            {
              "status": "affected",
              "version": "7.21.0"
            },
            {
              "status": "affected",
              "version": "7.20.1"
            },
            {
              "status": "affected",
              "version": "7.20.0"
            },
            {
              "status": "affected",
              "version": "7.19.7"
            },
            {
              "status": "affected",
              "version": "7.19.6"
            },
            {
              "status": "affected",
              "version": "7.19.5"
            },
            {
              "status": "affected",
              "version": "7.19.4"
            },
            {
              "status": "affected",
              "version": "7.19.3"
            },
            {
              "status": "affected",
              "version": "7.19.2"
            },
            {
              "status": "affected",
              "version": "7.19.1"
            },
            {
              "status": "affected",
              "version": "7.19.0"
            },
            {
              "status": "affected",
              "version": "7.18.2"
            },
            {
              "status": "affected",
              "version": "7.18.1"
            },
            {
              "status": "affected",
              "version": "7.18.0"
            },
            {
              "status": "affected",
              "version": "7.17.1"
            },
            {
              "status": "affected",
              "version": "7.17.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Stanislav Fort (Aisle Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-567",
              "description": "Unsynchronized Access to Shared Data in a Multi-threaded Context",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:02:27.813Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2025-14017.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2025-14017.html"
        }
      ],
      "title": "broken TLS options for threaded LDAPS",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "7.17.0"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.1"
                  },
                  {
                    "introduced": "8.17.0"
                  },
                  {
                    "fixed": "8.18.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "ccba0d10b6baf5c73cae8cf4fb3f29f0f55c5a34"
                  },
                  {
                    "fixed": "39d1976b7f709a516e3243338ebc0443bdd8d56d"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.17.0",
              "8.16.0",
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1",
              "8.11.0",
              "8.10.1",
              "8.10.0",
              "8.9.1",
              "8.9.0",
              "8.8.0",
              "8.7.1",
              "8.7.0",
              "8.6.0",
              "8.5.0",
              "8.4.0",
              "8.3.0",
              "8.2.1",
              "8.2.0",
              "8.1.2",
              "8.1.1",
              "8.1.0",
              "8.0.1",
              "8.0.0",
              "7.88.1",
              "7.88.0",
              "7.87.0",
              "7.86.0",
              "7.85.0",
              "7.84.0",
              "7.83.1",
              "7.83.0",
              "7.82.0",
              "7.81.0",
              "7.80.0",
              "7.79.1",
              "7.79.0",
              "7.78.0",
              "7.77.0",
              "7.76.1",
              "7.76.0",
              "7.75.0",
              "7.74.0",
              "7.73.0",
              "7.72.0",
              "7.71.1",
              "7.71.0",
              "7.70.0",
              "7.69.1",
              "7.69.0",
              "7.68.0",
              "7.67.0",
              "7.66.0",
              "7.65.3",
              "7.65.2",
              "7.65.1",
              "7.65.0",
              "7.64.1",
              "7.64.0",
              "7.63.0",
              "7.62.0",
              "7.61.1",
              "7.61.0",
              "7.60.0",
              "7.59.0",
              "7.58.0",
              "7.57.0",
              "7.56.1",
              "7.56.0",
              "7.55.1",
              "7.55.0",
              "7.54.1",
              "7.54.0",
              "7.53.1",
              "7.53.0",
              "7.52.1",
              "7.52.0",
              "7.51.0",
              "7.50.3",
              "7.50.2",
              "7.50.1",
              "7.50.0",
              "7.49.1",
              "7.49.0",
              "7.48.0",
              "7.47.1",
              "7.47.0",
              "7.46.0",
              "7.45.0",
              "7.44.0",
              "7.43.0",
              "7.42.1",
              "7.42.0",
              "7.41.0",
              "7.40.0",
              "7.39.0",
              "7.38.0",
              "7.37.1",
              "7.37.0",
              "7.36.0",
              "7.35.0",
              "7.34.0",
              "7.33.0",
              "7.32.0",
              "7.31.0",
              "7.30.0",
              "7.29.0",
              "7.28.1",
              "7.28.0",
              "7.27.0",
              "7.26.0",
              "7.25.0",
              "7.24.0",
              "7.23.1",
              "7.23.0",
              "7.22.0",
              "7.21.7",
              "7.21.6",
              "7.21.5",
              "7.21.4",
              "7.21.3",
              "7.21.2",
              "7.21.1",
              "7.21.0",
              "7.20.1",
              "7.20.0",
              "7.19.7",
              "7.19.6",
              "7.19.5",
              "7.19.4",
              "7.19.3",
              "7.19.2",
              "7.19.1",
              "7.19.0",
              "7.18.2",
              "7.18.1",
              "7.18.0",
              "7.17.1",
              "7.17.0"
            ]
          }
        ],
        "aliases": [
          "CVE-2025-14017"
        ],
        "credits": [
          {
            "name": "Stanislav Fort (Aisle Research)",
            "type": "finder"
          },
          {
            "name": "Daniel Stenberg",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Unsynchronized Access to Shared Data in a Multi-threaded Context",
            "id": "CWE-567"
          },
          "URL": "https://curl.se/docs/CVE-2025-14017.json",
          "affects": "lib",
          "award": {
            "amount": "2540",
            "currency": "USD"
          },
          "last_affected": "8.17.0",
          "package": "curl",
          "severity": "Medium",
          "www": "https://curl.se/docs/CVE-2025-14017.html"
        },
        "details": "When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well.",
        "id": "CURL-CVE-2025-14017",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2026-01-07T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "broken TLS options for threaded LDAPS"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2025-14017",
    "datePublished": "2026-01-08T10:07:05.554Z",
    "dateReserved": "2025-12-04T11:42:10.538Z",
    "dateUpdated": "2026-09-15T06:02:27.813Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14524 (GCVE-0-2025-14524)

Vulnerability from cvelistv5 – Published: 2026-01-08 10:07 – Updated: 2026-09-15 06:02

Title

bearer token leak on cross-protocol redirect

Summary

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-09 19:24 UTC

CWE

CWE-522 - Insufficiently Protected Credentials

Assigner

curl redhat root

References

4 references

URL	Tags
https://curl.se/docs/CVE-2025-14524.json
https://curl.se/docs/CVE-2025-14524.html
https://hackerone.com/reports/3459417
http://www.openwall.com/lists/oss-security/2026/01/07/4

Impacted products

3 products

Vendor	Product	Version
curl	curl	Affected: 7.33.0 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.18.0 (semver)
curl	curl	Affected: 06c1bea72faabb6fad4b7ef818aafaa336c9a7aa , < 1a822275d333dc6da6043497160fd04c8fa48640 (git)
curl	curl	Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0 Affected: 7.70.0 Affected: 7.69.1 Affected: 7.69.0 Affected: 7.68.0 Affected: 7.67.0 Affected: 7.66.0 Affected: 7.65.3 Affected: 7.65.2 Affected: 7.65.1 Affected: 7.65.0 Affected: 7.64.1 Affected: 7.64.0 Affected: 7.63.0 Affected: 7.62.0 Affected: 7.61.1 Affected: 7.61.0 Affected: 7.60.0 Affected: 7.59.0 Affected: 7.58.0 Affected: 7.57.0 Affected: 7.56.1 Affected: 7.56.0 Affected: 7.55.1 Affected: 7.55.0 Affected: 7.54.1 Affected: 7.54.0 Affected: 7.53.1 Affected: 7.53.0 Affected: 7.52.1 Affected: 7.52.0 Affected: 7.51.0 Affected: 7.50.3 Affected: 7.50.2 Affected: 7.50.1 Affected: 7.50.0 Affected: 7.49.1 Affected: 7.49.0 Affected: 7.48.0 Affected: 7.47.1 Affected: 7.47.0 Affected: 7.46.0 Affected: 7.45.0 Affected: 7.44.0 Affected: 7.43.0 Affected: 7.42.1 Affected: 7.42.0 Affected: 7.41.0 Affected: 7.40.0 Affected: 7.39.0 Affected: 7.38.0 Affected: 7.37.1 Affected: 7.37.0 Affected: 7.36.0 Affected: 7.35.0 Affected: 7.34.0 Affected: 7.33.0

Credits

anonymous237 on hackerone Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-08T11:06:18.117Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/07/4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-14524",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-09T19:24:54.231955Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-02T13:20:16.344Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "7.33.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.18.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "1a822275d333dc6da6043497160fd04c8fa48640",
              "status": "affected",
              "version": "06c1bea72faabb6fad4b7ef818aafaa336c9a7aa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            },
            {
              "status": "affected",
              "version": "8.7.1"
            },
            {
              "status": "affected",
              "version": "8.7.0"
            },
            {
              "status": "affected",
              "version": "8.6.0"
            },
            {
              "status": "affected",
              "version": "8.5.0"
            },
            {
              "status": "affected",
              "version": "8.4.0"
            },
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.2.1"
            },
            {
              "status": "affected",
              "version": "8.2.0"
            },
            {
              "status": "affected",
              "version": "8.1.2"
            },
            {
              "status": "affected",
              "version": "8.1.1"
            },
            {
              "status": "affected",
              "version": "8.1.0"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "7.88.1"
            },
            {
              "status": "affected",
              "version": "7.88.0"
            },
            {
              "status": "affected",
              "version": "7.87.0"
            },
            {
              "status": "affected",
              "version": "7.86.0"
            },
            {
              "status": "affected",
              "version": "7.85.0"
            },
            {
              "status": "affected",
              "version": "7.84.0"
            },
            {
              "status": "affected",
              "version": "7.83.1"
            },
            {
              "status": "affected",
              "version": "7.83.0"
            },
            {
              "status": "affected",
              "version": "7.82.0"
            },
            {
              "status": "affected",
              "version": "7.81.0"
            },
            {
              "status": "affected",
              "version": "7.80.0"
            },
            {
              "status": "affected",
              "version": "7.79.1"
            },
            {
              "status": "affected",
              "version": "7.79.0"
            },
            {
              "status": "affected",
              "version": "7.78.0"
            },
            {
              "status": "affected",
              "version": "7.77.0"
            },
            {
              "status": "affected",
              "version": "7.76.1"
            },
            {
              "status": "affected",
              "version": "7.76.0"
            },
            {
              "status": "affected",
              "version": "7.75.0"
            },
            {
              "status": "affected",
              "version": "7.74.0"
            },
            {
              "status": "affected",
              "version": "7.73.0"
            },
            {
              "status": "affected",
              "version": "7.72.0"
            },
            {
              "status": "affected",
              "version": "7.71.1"
            },
            {
              "status": "affected",
              "version": "7.71.0"
            },
            {
              "status": "affected",
              "version": "7.70.0"
            },
            {
              "status": "affected",
              "version": "7.69.1"
            },
            {
              "status": "affected",
              "version": "7.69.0"
            },
            {
              "status": "affected",
              "version": "7.68.0"
            },
            {
              "status": "affected",
              "version": "7.67.0"
            },
            {
              "status": "affected",
              "version": "7.66.0"
            },
            {
              "status": "affected",
              "version": "7.65.3"
            },
            {
              "status": "affected",
              "version": "7.65.2"
            },
            {
              "status": "affected",
              "version": "7.65.1"
            },
            {
              "status": "affected",
              "version": "7.65.0"
            },
            {
              "status": "affected",
              "version": "7.64.1"
            },
            {
              "status": "affected",
              "version": "7.64.0"
            },
            {
              "status": "affected",
              "version": "7.63.0"
            },
            {
              "status": "affected",
              "version": "7.62.0"
            },
            {
              "status": "affected",
              "version": "7.61.1"
            },
            {
              "status": "affected",
              "version": "7.61.0"
            },
            {
              "status": "affected",
              "version": "7.60.0"
            },
            {
              "status": "affected",
              "version": "7.59.0"
            },
            {
              "status": "affected",
              "version": "7.58.0"
            },
            {
              "status": "affected",
              "version": "7.57.0"
            },
            {
              "status": "affected",
              "version": "7.56.1"
            },
            {
              "status": "affected",
              "version": "7.56.0"
            },
            {
              "status": "affected",
              "version": "7.55.1"
            },
            {
              "status": "affected",
              "version": "7.55.0"
            },
            {
              "status": "affected",
              "version": "7.54.1"
            },
            {
              "status": "affected",
              "version": "7.54.0"
            },
            {
              "status": "affected",
              "version": "7.53.1"
            },
            {
              "status": "affected",
              "version": "7.53.0"
            },
            {
              "status": "affected",
              "version": "7.52.1"
            },
            {
              "status": "affected",
              "version": "7.52.0"
            },
            {
              "status": "affected",
              "version": "7.51.0"
            },
            {
              "status": "affected",
              "version": "7.50.3"
            },
            {
              "status": "affected",
              "version": "7.50.2"
            },
            {
              "status": "affected",
              "version": "7.50.1"
            },
            {
              "status": "affected",
              "version": "7.50.0"
            },
            {
              "status": "affected",
              "version": "7.49.1"
            },
            {
              "status": "affected",
              "version": "7.49.0"
            },
            {
              "status": "affected",
              "version": "7.48.0"
            },
            {
              "status": "affected",
              "version": "7.47.1"
            },
            {
              "status": "affected",
              "version": "7.47.0"
            },
            {
              "status": "affected",
              "version": "7.46.0"
            },
            {
              "status": "affected",
              "version": "7.45.0"
            },
            {
              "status": "affected",
              "version": "7.44.0"
            },
            {
              "status": "affected",
              "version": "7.43.0"
            },
            {
              "status": "affected",
              "version": "7.42.1"
            },
            {
              "status": "affected",
              "version": "7.42.0"
            },
            {
              "status": "affected",
              "version": "7.41.0"
            },
            {
              "status": "affected",
              "version": "7.40.0"
            },
            {
              "status": "affected",
              "version": "7.39.0"
            },
            {
              "status": "affected",
              "version": "7.38.0"
            },
            {
              "status": "affected",
              "version": "7.37.1"
            },
            {
              "status": "affected",
              "version": "7.37.0"
            },
            {
              "status": "affected",
              "version": "7.36.0"
            },
            {
              "status": "affected",
              "version": "7.35.0"
            },
            {
              "status": "affected",
              "version": "7.34.0"
            },
            {
              "status": "affected",
              "version": "7.33.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "anonymous237 on hackerone"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:02:29.317Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2025-14524.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2025-14524.html"
        },
        {
          "url": "https://hackerone.com/reports/3459417"
        }
      ],
      "title": "bearer token leak on cross-protocol redirect",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "7.33.0"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.1"
                  },
                  {
                    "introduced": "8.17.0"
                  },
                  {
                    "fixed": "8.18.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "06c1bea72faabb6fad4b7ef818aafaa336c9a7aa"
                  },
                  {
                    "fixed": "1a822275d333dc6da6043497160fd04c8fa48640"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.17.0",
              "8.16.0",
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1",
              "8.11.0",
              "8.10.1",
              "8.10.0",
              "8.9.1",
              "8.9.0",
              "8.8.0",
              "8.7.1",
              "8.7.0",
              "8.6.0",
              "8.5.0",
              "8.4.0",
              "8.3.0",
              "8.2.1",
              "8.2.0",
              "8.1.2",
              "8.1.1",
              "8.1.0",
              "8.0.1",
              "8.0.0",
              "7.88.1",
              "7.88.0",
              "7.87.0",
              "7.86.0",
              "7.85.0",
              "7.84.0",
              "7.83.1",
              "7.83.0",
              "7.82.0",
              "7.81.0",
              "7.80.0",
              "7.79.1",
              "7.79.0",
              "7.78.0",
              "7.77.0",
              "7.76.1",
              "7.76.0",
              "7.75.0",
              "7.74.0",
              "7.73.0",
              "7.72.0",
              "7.71.1",
              "7.71.0",
              "7.70.0",
              "7.69.1",
              "7.69.0",
              "7.68.0",
              "7.67.0",
              "7.66.0",
              "7.65.3",
              "7.65.2",
              "7.65.1",
              "7.65.0",
              "7.64.1",
              "7.64.0",
              "7.63.0",
              "7.62.0",
              "7.61.1",
              "7.61.0",
              "7.60.0",
              "7.59.0",
              "7.58.0",
              "7.57.0",
              "7.56.1",
              "7.56.0",
              "7.55.1",
              "7.55.0",
              "7.54.1",
              "7.54.0",
              "7.53.1",
              "7.53.0",
              "7.52.1",
              "7.52.0",
              "7.51.0",
              "7.50.3",
              "7.50.2",
              "7.50.1",
              "7.50.0",
              "7.49.1",
              "7.49.0",
              "7.48.0",
              "7.47.1",
              "7.47.0",
              "7.46.0",
              "7.45.0",
              "7.44.0",
              "7.43.0",
              "7.42.1",
              "7.42.0",
              "7.41.0",
              "7.40.0",
              "7.39.0",
              "7.38.0",
              "7.37.1",
              "7.37.0",
              "7.36.0",
              "7.35.0",
              "7.34.0",
              "7.33.0"
            ]
          }
        ],
        "aliases": [
          "CVE-2025-14524"
        ],
        "credits": [
          {
            "name": "anonymous237 on hackerone",
            "type": "finder"
          },
          {
            "name": "Daniel Stenberg",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Insufficiently Protected Credentials",
            "id": "CWE-522"
          },
          "URL": "https://curl.se/docs/CVE-2025-14524.json",
          "affects": "both",
          "award": {
            "amount": "505",
            "currency": "USD"
          },
          "issue": "https://hackerone.com/reports/3459417",
          "last_affected": "8.17.0",
          "package": "curl",
          "severity": "Low",
          "www": "https://curl.se/docs/CVE-2025-14524.html"
        },
        "details": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
        "id": "CURL-CVE-2025-14524",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2026-01-07T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "bearer token leak on cross-protocol redirect"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2025-14524",
    "datePublished": "2026-01-08T10:07:25.655Z",
    "dateReserved": "2025-12-11T08:04:14.328Z",
    "dateUpdated": "2026-09-15T06:02:29.317Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14819 (GCVE-0-2025-14819)

Vulnerability from cvelistv5 – Published: 2026-01-08 10:07 – Updated: 2026-09-15 06:02

Title

OpenSSL partial chain store policy bypass

Summary

When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-08 15:00 UTC

CWE

CWE-295 - Improper Certificate Validation

Assigner

curl redhat root

References

3 references

URL	Tags
https://curl.se/docs/CVE-2025-14819.json
https://curl.se/docs/CVE-2025-14819.html
http://www.openwall.com/lists/oss-security/2026/01/07/5

Impacted products

3 products

Vendor	Product	Version
curl	curl	Affected: 7.87.0 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.18.0 (semver)
curl	curl	Affected: 3c16697ebd796f799227be293e8689aec5f8190d , < cd046f6c93b39d673a58c18648d8906e954c4f5d (git)
curl	curl	Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0

Credits

Stanislav Fort (Aisle Research) Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-08T11:06:19.910Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/07/5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-14819",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-08T15:00:02.949618Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-295",
                "description": "CWE-295 Improper Certificate Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-08T15:02:04.303Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "7.87.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.18.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "cd046f6c93b39d673a58c18648d8906e954c4f5d",
              "status": "affected",
              "version": "3c16697ebd796f799227be293e8689aec5f8190d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            },
            {
              "status": "affected",
              "version": "8.7.1"
            },
            {
              "status": "affected",
              "version": "8.7.0"
            },
            {
              "status": "affected",
              "version": "8.6.0"
            },
            {
              "status": "affected",
              "version": "8.5.0"
            },
            {
              "status": "affected",
              "version": "8.4.0"
            },
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.2.1"
            },
            {
              "status": "affected",
              "version": "8.2.0"
            },
            {
              "status": "affected",
              "version": "8.1.2"
            },
            {
              "status": "affected",
              "version": "8.1.1"
            },
            {
              "status": "affected",
              "version": "8.1.0"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "7.88.1"
            },
            {
              "status": "affected",
              "version": "7.88.0"
            },
            {
              "status": "affected",
              "version": "7.87.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Stanislav Fort (Aisle Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When doing TLS related transfers with reused easy or multi handles and\naltering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user\u0027s wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:02:30.824Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2025-14819.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2025-14819.html"
        }
      ],
      "title": "OpenSSL partial chain store policy bypass",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "7.87.0"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.1"
                  },
                  {
                    "introduced": "8.17.0"
                  },
                  {
                    "fixed": "8.18.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "3c16697ebd796f799227be293e8689aec5f8190d"
                  },
                  {
                    "fixed": "cd046f6c93b39d673a58c18648d8906e954c4f5d"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.17.0",
              "8.16.0",
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1",
              "8.11.0",
              "8.10.1",
              "8.10.0",
              "8.9.1",
              "8.9.0",
              "8.8.0",
              "8.7.1",
              "8.7.0",
              "8.6.0",
              "8.5.0",
              "8.4.0",
              "8.3.0",
              "8.2.1",
              "8.2.0",
              "8.1.2",
              "8.1.1",
              "8.1.0",
              "8.0.1",
              "8.0.0",
              "7.88.1",
              "7.88.0",
              "7.87.0"
            ]
          }
        ],
        "aliases": [
          "CVE-2025-14819"
        ],
        "credits": [
          {
            "name": "Stanislav Fort (Aisle Research)",
            "type": "finder"
          },
          {
            "name": "Daniel Stenberg",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Improper Certificate Validation",
            "id": "CWE-295"
          },
          "URL": "https://curl.se/docs/CVE-2025-14819.json",
          "affects": "lib",
          "award": {
            "amount": "505",
            "currency": "USD"
          },
          "last_affected": "8.17.0",
          "package": "curl",
          "severity": "Low",
          "www": "https://curl.se/docs/CVE-2025-14819.html"
        },
        "details": "When doing TLS related transfers with reused easy or multi handles and\naltering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user\u0027s wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.",
        "id": "CURL-CVE-2025-14819",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2026-01-07T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "OpenSSL partial chain store policy bypass"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2025-14819",
    "datePublished": "2026-01-08T10:07:54.408Z",
    "dateReserved": "2025-12-17T09:55:27.969Z",
    "dateUpdated": "2026-09-15T06:02:30.824Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-15079 (GCVE-0-2025-15079)

Vulnerability from cvelistv5 – Published: 2026-01-08 10:08 – Updated: 2026-09-15 06:02

Title

libssh global known_hosts override

Summary

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-08 14:45 UTC

CWE

CWE-297 - Improper Validation of Certificate with Host Mismatch

Assigner

curl redhat root

References

4 references

URL	Tags
https://curl.se/docs/CVE-2025-15079.json
https://curl.se/docs/CVE-2025-15079.html
https://hackerone.com/reports/3477116
http://www.openwall.com/lists/oss-security/2026/01/07/6

Impacted products

3 products

Vendor	Product	Version
curl	curl	Affected: 7.58.0 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.18.0 (semver)
curl	curl	Affected: c92d2e14cfb0db662f958effd2ac86f995cf1b5a , < adca486c125d9a6d9565b9607a19dce803a8b479 (git)
curl	curl	Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0 Affected: 7.70.0 Affected: 7.69.1 Affected: 7.69.0 Affected: 7.68.0 Affected: 7.67.0 Affected: 7.66.0 Affected: 7.65.3 Affected: 7.65.2 Affected: 7.65.1 Affected: 7.65.0 Affected: 7.64.1 Affected: 7.64.0 Affected: 7.63.0 Affected: 7.62.0 Affected: 7.61.1 Affected: 7.61.0 Affected: 7.60.0 Affected: 7.59.0 Affected: 7.58.0

Credits

Harry Sintonen Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-08T11:06:21.628Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/07/6"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-15079",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-08T14:45:34.542278Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-297",
                "description": "CWE-297 Improper Validation of Certificate with Host Mismatch",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-08T14:46:47.042Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "7.58.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.18.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "adca486c125d9a6d9565b9607a19dce803a8b479",
              "status": "affected",
              "version": "c92d2e14cfb0db662f958effd2ac86f995cf1b5a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            },
            {
              "status": "affected",
              "version": "8.7.1"
            },
            {
              "status": "affected",
              "version": "8.7.0"
            },
            {
              "status": "affected",
              "version": "8.6.0"
            },
            {
              "status": "affected",
              "version": "8.5.0"
            },
            {
              "status": "affected",
              "version": "8.4.0"
            },
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.2.1"
            },
            {
              "status": "affected",
              "version": "8.2.0"
            },
            {
              "status": "affected",
              "version": "8.1.2"
            },
            {
              "status": "affected",
              "version": "8.1.1"
            },
            {
              "status": "affected",
              "version": "8.1.0"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "7.88.1"
            },
            {
              "status": "affected",
              "version": "7.88.0"
            },
            {
              "status": "affected",
              "version": "7.87.0"
            },
            {
              "status": "affected",
              "version": "7.86.0"
            },
            {
              "status": "affected",
              "version": "7.85.0"
            },
            {
              "status": "affected",
              "version": "7.84.0"
            },
            {
              "status": "affected",
              "version": "7.83.1"
            },
            {
              "status": "affected",
              "version": "7.83.0"
            },
            {
              "status": "affected",
              "version": "7.82.0"
            },
            {
              "status": "affected",
              "version": "7.81.0"
            },
            {
              "status": "affected",
              "version": "7.80.0"
            },
            {
              "status": "affected",
              "version": "7.79.1"
            },
            {
              "status": "affected",
              "version": "7.79.0"
            },
            {
              "status": "affected",
              "version": "7.78.0"
            },
            {
              "status": "affected",
              "version": "7.77.0"
            },
            {
              "status": "affected",
              "version": "7.76.1"
            },
            {
              "status": "affected",
              "version": "7.76.0"
            },
            {
              "status": "affected",
              "version": "7.75.0"
            },
            {
              "status": "affected",
              "version": "7.74.0"
            },
            {
              "status": "affected",
              "version": "7.73.0"
            },
            {
              "status": "affected",
              "version": "7.72.0"
            },
            {
              "status": "affected",
              "version": "7.71.1"
            },
            {
              "status": "affected",
              "version": "7.71.0"
            },
            {
              "status": "affected",
              "version": "7.70.0"
            },
            {
              "status": "affected",
              "version": "7.69.1"
            },
            {
              "status": "affected",
              "version": "7.69.0"
            },
            {
              "status": "affected",
              "version": "7.68.0"
            },
            {
              "status": "affected",
              "version": "7.67.0"
            },
            {
              "status": "affected",
              "version": "7.66.0"
            },
            {
              "status": "affected",
              "version": "7.65.3"
            },
            {
              "status": "affected",
              "version": "7.65.2"
            },
            {
              "status": "affected",
              "version": "7.65.1"
            },
            {
              "status": "affected",
              "version": "7.65.0"
            },
            {
              "status": "affected",
              "version": "7.64.1"
            },
            {
              "status": "affected",
              "version": "7.64.0"
            },
            {
              "status": "affected",
              "version": "7.63.0"
            },
            {
              "status": "affected",
              "version": "7.62.0"
            },
            {
              "status": "affected",
              "version": "7.61.1"
            },
            {
              "status": "affected",
              "version": "7.61.0"
            },
            {
              "status": "affected",
              "version": "7.60.0"
            },
            {
              "status": "affected",
              "version": "7.59.0"
            },
            {
              "status": "affected",
              "version": "7.58.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Harry Sintonen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-297",
              "description": "Improper Validation of Certificate with Host Mismatch",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:02:32.246Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2025-15079.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2025-15079.html"
        },
        {
          "url": "https://hackerone.com/reports/3477116"
        }
      ],
      "title": "libssh global known_hosts override",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "7.58.0"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.1"
                  },
                  {
                    "introduced": "8.17.0"
                  },
                  {
                    "fixed": "8.18.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "c92d2e14cfb0db662f958effd2ac86f995cf1b5a"
                  },
                  {
                    "fixed": "adca486c125d9a6d9565b9607a19dce803a8b479"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.17.0",
              "8.16.0",
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1",
              "8.11.0",
              "8.10.1",
              "8.10.0",
              "8.9.1",
              "8.9.0",
              "8.8.0",
              "8.7.1",
              "8.7.0",
              "8.6.0",
              "8.5.0",
              "8.4.0",
              "8.3.0",
              "8.2.1",
              "8.2.0",
              "8.1.2",
              "8.1.1",
              "8.1.0",
              "8.0.1",
              "8.0.0",
              "7.88.1",
              "7.88.0",
              "7.87.0",
              "7.86.0",
              "7.85.0",
              "7.84.0",
              "7.83.1",
              "7.83.0",
              "7.82.0",
              "7.81.0",
              "7.80.0",
              "7.79.1",
              "7.79.0",
              "7.78.0",
              "7.77.0",
              "7.76.1",
              "7.76.0",
              "7.75.0",
              "7.74.0",
              "7.73.0",
              "7.72.0",
              "7.71.1",
              "7.71.0",
              "7.70.0",
              "7.69.1",
              "7.69.0",
              "7.68.0",
              "7.67.0",
              "7.66.0",
              "7.65.3",
              "7.65.2",
              "7.65.1",
              "7.65.0",
              "7.64.1",
              "7.64.0",
              "7.63.0",
              "7.62.0",
              "7.61.1",
              "7.61.0",
              "7.60.0",
              "7.59.0",
              "7.58.0"
            ]
          }
        ],
        "aliases": [
          "CVE-2025-15079"
        ],
        "credits": [
          {
            "name": "Harry Sintonen",
            "type": "finder"
          },
          {
            "name": "Daniel Stenberg",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Improper Validation of Certificate with Host Mismatch",
            "id": "CWE-297"
          },
          "URL": "https://curl.se/docs/CVE-2025-15079.json",
          "affects": "both",
          "award": {
            "amount": "505",
            "currency": "USD"
          },
          "issue": "https://hackerone.com/reports/3477116",
          "last_affected": "8.17.0",
          "package": "curl",
          "severity": "Low",
          "www": "https://curl.se/docs/CVE-2025-15079.html"
        },
        "details": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
        "id": "CURL-CVE-2025-15079",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2026-01-07T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "libssh global known_hosts override"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2025-15079",
    "datePublished": "2026-01-08T10:08:13.410Z",
    "dateReserved": "2025-12-24T22:18:18.481Z",
    "dateUpdated": "2026-09-15T06:02:32.246Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-15224 (GCVE-0-2025-15224)

Vulnerability from cvelistv5 – Published: 2026-01-08 10:08 – Updated: 2026-09-15 06:02

Title

libssh key passphrase bypass without agent set

Summary

When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-08 14:38 UTC

CWE

CWE-287 - Improper Authentication

Assigner

curl redhat root

References

4 references

URL	Tags
https://curl.se/docs/CVE-2025-15224.json
https://curl.se/docs/CVE-2025-15224.html
https://hackerone.com/reports/3480925
http://www.openwall.com/lists/oss-security/2026/01/07/7

Impacted products

3 products

Vendor	Product	Version
curl	curl	Affected: 7.58.0 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.18.0 (semver)
curl	curl	Affected: c92d2e14cfb0db662f958effd2ac86f995cf1b5a , < 16d5f2a5660c61cc27bd5f1c7f512391d1c927aa (git)
curl	curl	Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0 Affected: 7.70.0 Affected: 7.69.1 Affected: 7.69.0 Affected: 7.68.0 Affected: 7.67.0 Affected: 7.66.0 Affected: 7.65.3 Affected: 7.65.2 Affected: 7.65.1 Affected: 7.65.0 Affected: 7.64.1 Affected: 7.64.0 Affected: 7.63.0 Affected: 7.62.0 Affected: 7.61.1 Affected: 7.61.0 Affected: 7.60.0 Affected: 7.59.0 Affected: 7.58.0

Credits

Harry Sintonen Harry Sintonen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-08T11:06:23.372Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/07/7"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 3.1,
              "baseSeverity": "LOW",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-15224",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-08T14:38:20.832987Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-287",
                "description": "CWE-287 Improper Authentication",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-08T14:39:55.278Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "7.58.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.18.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "16d5f2a5660c61cc27bd5f1c7f512391d1c927aa",
              "status": "affected",
              "version": "c92d2e14cfb0db662f958effd2ac86f995cf1b5a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            },
            {
              "status": "affected",
              "version": "8.7.1"
            },
            {
              "status": "affected",
              "version": "8.7.0"
            },
            {
              "status": "affected",
              "version": "8.6.0"
            },
            {
              "status": "affected",
              "version": "8.5.0"
            },
            {
              "status": "affected",
              "version": "8.4.0"
            },
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.2.1"
            },
            {
              "status": "affected",
              "version": "8.2.0"
            },
            {
              "status": "affected",
              "version": "8.1.2"
            },
            {
              "status": "affected",
              "version": "8.1.1"
            },
            {
              "status": "affected",
              "version": "8.1.0"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "7.88.1"
            },
            {
              "status": "affected",
              "version": "7.88.0"
            },
            {
              "status": "affected",
              "version": "7.87.0"
            },
            {
              "status": "affected",
              "version": "7.86.0"
            },
            {
              "status": "affected",
              "version": "7.85.0"
            },
            {
              "status": "affected",
              "version": "7.84.0"
            },
            {
              "status": "affected",
              "version": "7.83.1"
            },
            {
              "status": "affected",
              "version": "7.83.0"
            },
            {
              "status": "affected",
              "version": "7.82.0"
            },
            {
              "status": "affected",
              "version": "7.81.0"
            },
            {
              "status": "affected",
              "version": "7.80.0"
            },
            {
              "status": "affected",
              "version": "7.79.1"
            },
            {
              "status": "affected",
              "version": "7.79.0"
            },
            {
              "status": "affected",
              "version": "7.78.0"
            },
            {
              "status": "affected",
              "version": "7.77.0"
            },
            {
              "status": "affected",
              "version": "7.76.1"
            },
            {
              "status": "affected",
              "version": "7.76.0"
            },
            {
              "status": "affected",
              "version": "7.75.0"
            },
            {
              "status": "affected",
              "version": "7.74.0"
            },
            {
              "status": "affected",
              "version": "7.73.0"
            },
            {
              "status": "affected",
              "version": "7.72.0"
            },
            {
              "status": "affected",
              "version": "7.71.1"
            },
            {
              "status": "affected",
              "version": "7.71.0"
            },
            {
              "status": "affected",
              "version": "7.70.0"
            },
            {
              "status": "affected",
              "version": "7.69.1"
            },
            {
              "status": "affected",
              "version": "7.69.0"
            },
            {
              "status": "affected",
              "version": "7.68.0"
            },
            {
              "status": "affected",
              "version": "7.67.0"
            },
            {
              "status": "affected",
              "version": "7.66.0"
            },
            {
              "status": "affected",
              "version": "7.65.3"
            },
            {
              "status": "affected",
              "version": "7.65.2"
            },
            {
              "status": "affected",
              "version": "7.65.1"
            },
            {
              "status": "affected",
              "version": "7.65.0"
            },
            {
              "status": "affected",
              "version": "7.64.1"
            },
            {
              "status": "affected",
              "version": "7.64.0"
            },
            {
              "status": "affected",
              "version": "7.63.0"
            },
            {
              "status": "affected",
              "version": "7.62.0"
            },
            {
              "status": "affected",
              "version": "7.61.1"
            },
            {
              "status": "affected",
              "version": "7.61.0"
            },
            {
              "status": "affected",
              "version": "7.60.0"
            },
            {
              "status": "affected",
              "version": "7.59.0"
            },
            {
              "status": "affected",
              "version": "7.58.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Harry Sintonen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Harry Sintonen"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:02:33.722Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2025-15224.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2025-15224.html"
        },
        {
          "url": "https://hackerone.com/reports/3480925"
        }
      ],
      "title": "libssh key passphrase bypass without agent set",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "7.58.0"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.1"
                  },
                  {
                    "introduced": "8.17.0"
                  },
                  {
                    "fixed": "8.18.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "c92d2e14cfb0db662f958effd2ac86f995cf1b5a"
                  },
                  {
                    "fixed": "16d5f2a5660c61cc27bd5f1c7f512391d1c927aa"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.17.0",
              "8.16.0",
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1",
              "8.11.0",
              "8.10.1",
              "8.10.0",
              "8.9.1",
              "8.9.0",
              "8.8.0",
              "8.7.1",
              "8.7.0",
              "8.6.0",
              "8.5.0",
              "8.4.0",
              "8.3.0",
              "8.2.1",
              "8.2.0",
              "8.1.2",
              "8.1.1",
              "8.1.0",
              "8.0.1",
              "8.0.0",
              "7.88.1",
              "7.88.0",
              "7.87.0",
              "7.86.0",
              "7.85.0",
              "7.84.0",
              "7.83.1",
              "7.83.0",
              "7.82.0",
              "7.81.0",
              "7.80.0",
              "7.79.1",
              "7.79.0",
              "7.78.0",
              "7.77.0",
              "7.76.1",
              "7.76.0",
              "7.75.0",
              "7.74.0",
              "7.73.0",
              "7.72.0",
              "7.71.1",
              "7.71.0",
              "7.70.0",
              "7.69.1",
              "7.69.0",
              "7.68.0",
              "7.67.0",
              "7.66.0",
              "7.65.3",
              "7.65.2",
              "7.65.1",
              "7.65.0",
              "7.64.1",
              "7.64.0",
              "7.63.0",
              "7.62.0",
              "7.61.1",
              "7.61.0",
              "7.60.0",
              "7.59.0",
              "7.58.0"
            ]
          }
        ],
        "aliases": [
          "CVE-2025-15224"
        ],
        "credits": [
          {
            "name": "Harry Sintonen",
            "type": "finder"
          },
          {
            "name": "Harry Sintonen",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Improper Authentication",
            "id": "CWE-287"
          },
          "URL": "https://curl.se/docs/CVE-2025-15224.json",
          "affects": "both",
          "award": {
            "amount": "505",
            "currency": "USD"
          },
          "issue": "https://hackerone.com/reports/3480925",
          "last_affected": "8.17.0",
          "package": "curl",
          "severity": "Low",
          "www": "https://curl.se/docs/CVE-2025-15224.html"
        },
        "details": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.",
        "id": "CURL-CVE-2025-15224",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2026-01-07T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "libssh key passphrase bypass without agent set"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2025-15224",
    "datePublished": "2026-01-08T10:08:27.516Z",
    "dateReserved": "2025-12-28T22:49:58.556Z",
    "dateUpdated": "2026-09-15T06:02:33.722Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:20031-1

CVE-2025-14017 (GCVE-0-2025-14017)

CVE-2025-14524 (GCVE-0-2025-14524)

CVE-2025-14819 (GCVE-0-2025-14819)

CVE-2025-15079 (GCVE-0-2025-15079)

CVE-2025-15224 (GCVE-0-2025-15224)

Tags

Sightings

Nomenclature

Related by attack behaviour