CVEvulnerability
CVE-2025-10966
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2025-11-07
- Last modified
- 2026-10-19
- Assigner
- 2499f714-1537-4658-8207-48ae4bb9eae9
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-322
Description
curl's code for managing SSH connections when SFTP was done using the wolfSSH
powered backend was flawed and missed host verification mechanisms.
This prevents curl from detecting MITM attackers and more.
Affected configurations
• haxx curl (>= 7.69.0 < 8.17.0)
Related
Weakness · CWE (1)
- CWE-322 Key Exchange without Entity Authentication weakness
References
- https://curl.se/docs/CVE-2025-10966.html Patch, Vendor Advisory
- https://curl.se/docs/CVE-2025-10966.json Vendor Advisory
- https://hackerone.com/reports/3355218 Exploit, Issue Tracking, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2025/11/05/2 Mailing List, Patch, Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html cert-portal.siemens.com