Curl

Curl Security Releases - February 2025

curl-2025-02 Feb 1, 2025 Source: Vendor

Curl security advisories for February 2025, compiled from CVE.org records.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.cve.org/CVERecord?id=CVE-2025-0167

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

3 lines

Showing 1–3 of 3

CVE-2025-0167 BR2025-0000-031869 curl unclaimed

When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This f...

Credited as Yihang Zhou

CVE-2025-0665 BR2025-0000-031871 curl unclaimed

libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve.

Credited as Christian Heusel

CVE-2025-0725 BR2025-0000-031872 curl unclaimed

When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled in...

Credited as z2_