CVEvulnerability
CVE-2025-0725
7.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2025-02-05
- Last modified
- 2026-10-15
- Assigner
- 2499f714-1537-4658-8207-48ae4bb9eae9
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.3 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-120
Description
When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,
**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would
make libcurl perform a buffer overflow.
Affected configurations
• netapp hci baseboard management controller
• netapp hci h610s firmware
• netapp hci h610c firmware
• netapp hci h615c firmware
• netapp solidfire \& hci management node
• netapp solidfire \& hci storage node
• haxx curl (>= 7.10.5 < 8.12.0)
• haxx libcurl (>= 7.10.5 < 8.12.0)
Related
Weakness · CWE (1)
- CWE-120 Buffer Copy without Checking Size of Input weakness
References
- https://curl.se/docs/CVE-2025-0725.html Vendor Advisory
- https://curl.se/docs/CVE-2025-0725.json Vendor Advisory
- https://hackerone.com/reports/2956023 Exploit, Issue Tracking
- http://www.openwall.com/lists/oss-security/2025/02/05/3 Mailing List
- http://www.openwall.com/lists/oss-security/2025/02/06/2 Mailing List
- http://www.openwall.com/lists/oss-security/2025/02/06/4 Mailing List
- https://github.com/curl/curl/commit/76f83f0db23846e254d940ec7 Patch
- https://security.netapp.com/advisory/ntap-20250306-0009/ Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-089022.html cert-portal.siemens.com
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html cert-portal.siemens.com