CVE-2025-14819

Katalog CVE

CVSS 5.3 · Medium EPSS 0,76%

Kerentanan Improper Certificate Validation pada haxx curl. Skor CVSS 3.1 5.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.

Rincian

Terbit di NVD

8 Januari 2026

Terakhir diubah

15 September 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

0,76% peluang dieksploitasi; lebih tinggi dari 53,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://curl.se/docs/CVE-2025-14819.html mitigasi · patch · advisory vendor
• https://curl.se/docs/CVE-2025-14819.json advisory vendor
• http://www.openwall.com/lists/oss-security/2026/01/07/5 mailing list · mitigasi · patch · advisory pihak ketiga