CVE-2025-10966

Katalog CVE

CVSS 4.3 · Medium EPSS 0,43%

Kerentanan Key Exchange without Entity Authentication pada haxx curl. Skor CVSS 3.1 4.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

Rincian

Terbit di NVD

7 November 2025

Terakhir diubah

15 September 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-322: Key Exchange without Entity Authentication

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://curl.se/docs/CVE-2025-10966.html patch · advisory vendor
• https://curl.se/docs/CVE-2025-10966.json advisory vendor
• http://www.openwall.com/lists/oss-security/2025/11/05/2 mailing list · patch · advisory pihak ketiga
• https://hackerone.com/reports/3355218 exploit · issue tracking · advisory pihak ketiga
• https://cert-portal.siemens.com/productcert/html/ssa-253495.html