CVE-2025-14017

Katalog CVE

CVSS 6.3 · Medium EPSS 0,11%

Kerentanan Unsynchronized Access to Shared Data in a Multithreaded Context pada haxx curl. Skor CVSS 3.1 6.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.

Rincian

Terbit di NVD

8 Januari 2026

Terakhir diubah

15 September 2026

Status NVD

Modified

CVSS 3.1

6.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context

EPSS (30 hari)

0,11% peluang dieksploitasi; lebih tinggi dari 1,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://curl.se/docs/CVE-2025-14017.html advisory vendor
• https://curl.se/docs/CVE-2025-14017.json advisory vendor
• http://www.openwall.com/lists/oss-security/2026/01/07/3 mailing list · advisory pihak ketiga