GitHub Advisoryadvisory · NuGet

GHSA-px2c-r924-mwcc Couchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates

MEDIUM Published 2025-06-18 Modified 2026-10-19 Official page ↗
Aliases
CVE-2025-49015
Ecosystem
NuGet
Packages
CouchbaseNetClient
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-297
Reviewed
2025-06-18

Affected packages

• NuGet CouchbaseNetClient: < 3.7.1 → fixed in 3.7.1

Description

The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.

Related

Alias · CVE (1)

  • CVE-2025-49015 The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. vulnerability

Weakness · CWE (1)

  • CWE-297 Improper Validation of Certificate with Host Mismatch weakness

References