Description (CNA)
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| curl / curl | affected 7.69.0 before 8.14.2; affected 8.15.0 before 8.16.1 |
| curl / curl | affected 6773c7ca65cf2183295e56603f9b86a5ce816a06 before b011e3fcfb06d6c0278595ee2ee297036fbe9793 |
| curl / curl | affected 8.16.0; affected 8.15.0; affected 8.14.1; affected 8.14.0; affected 8.13.0; affected 8.12.1; affected 8.12.0; affected 8.11.1; affected 8.11.0; affected 8.10.1; affected 8.10.0; affected 8.9.1; affected 8.9.0; affected 8.8.0; affected 8.7.1; affected 8.7.0; affected 8.6.0; affected 8.5.0; affected 8.4.0; affected 8.3.0; affected 8.2.1; affected 8.2.0; affected 8.1.2; affected 8.1.1; affected 8.1.0; affected 8.0.1; affected 8.0.0; affected 7.88.1; affected 7.88.0; affected 7.87.0; affected 7.86.0; affected 7.85.0; affected 7.84.0; affected 7.83.1; affected 7.83.0; affected 7.82.0; affected 7.81.0; affected 7.80.0; affected 7.79.1; affected 7.79.0; affected 7.78.0; affected 7.77.0; affected 7.76.1; affected 7.76.0; affected 7.75.0; affected 7.74.0; affected 7.73.0; affected 7.72.0; affected 7.71.1; affected 7.71.0; affected 7.70.0; affected 7.69.1; affected 7.69.0 |
CWE
CWE-322
References
- https://curl.se/docs/CVE-2025-10966.json
- https://curl.se/docs/CVE-2025-10966.html
- https://hackerone.com/reports/3355218
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.
No English description supplied.