CVE-2025-10966
Fixed in a distro release EPSS <1%CVSS 4.3
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.
Products: curl, Siemens RUGGEDCOM RST2428P
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.23 | curl | 8.17.0-r0 |
| Alpine 3.24 | curl | 8.17.0-r0 |
| Amazon Linux 2 | curl | 8.3.0-1.amzn2.0.12 |
| Amazon Linux 2 | libcurl | 8.3.0-1.amzn2.0.12 |
| Amazon Linux 2 | libcurl-devel | 8.3.0-1.amzn2.0.12 |
| Amazon Linux 2023 | curl | 8.15.0-4.amzn2023.0.1 |
| Amazon Linux 2023 | curl-minimal | 8.15.0-4.amzn2023.0.1 |
| Amazon Linux 2023 | libcurl | 8.15.0-4.amzn2023.0.1 |
| Amazon Linux 2023 | libcurl-devel | 8.15.0-4.amzn2023.0.1 |
| Amazon Linux 2023 | libcurl-minimal | 8.15.0-4.amzn2023.0.1 |
| Debian 12 | curl | no fix |
| Debian 13 | curl | no fix |
| Debian 14 | curl | 8.17.0~rc2-1 |
| Red Hat hummingbird 1 | curl | 0:8.19.0-3.hum1 |
| Red Hat hummingbird 1 | libcurl | 0:8.19.0-3.hum1 |
| Red Hat hummingbird 1 | libcurl-devel | 0:8.19.0-3.hum1 |
| Red Hat hummingbird 1 | libcurl-minimal | 0:8.19.0-3.hum1 |
| openSUSE Tumbleweed | curl | 8.17.0-1.1 |