Curl
Curl Security Releases - February 2025
curl-2025-02 Feb 1, 2025 Source: Vendor
Curl security advisories for February 2025, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2025-0167
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
3 lines
Showing 1–3 of 3 matching , clear filters
CVE-2025-0167
BR2025-0000-031869
curl
unclaimed
When asked to use a `.netrc` file for credentials **and** to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circumstances.
This f...
Credited as Yihang Zhou
CVE-2025-0665
BR2025-0000-031871
curl
unclaimed
libcurl would wrongly close the same eventfd file descriptor twice when taking
down a connection channel after having completed a threaded name resolve.
Credited as Christian Heusel
CVE-2025-0725
BR2025-0000-031872
curl
unclaimed
When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,
**using zlib 1.2.0.3 or older**, an attacker-controlled in...
Credited as z2_