Resource management error in cURL - CVE-2025-0665

Vulnerability identifier: #VU103647

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-0665

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when built with the threaded resolver. A remote attacker can force the application to wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve

cURL
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Slackware Linux
Basesystem Module
openSUSE Leap
Anolis OS
EasyApache
IBM Automation Decision Services
SecurityCenter
LANTIME Operating System Firmware (LTOS)
curl
libcurl
curl-minimal
curl-doc
libcurl-debuginfo
libcurl-devel
libcurl-minimal
libcurl4-64bit
libcurl-devel-64bit
libcurl4-64bit-debuginfo
libcurl4-32bit
libcurl-devel-32bit
libcurl4-32bit-debuginfo
curl-fish-completion
libcurl-devel-doc
curl-zsh-completion
curl-debugsource
curl-debuginfo
curl-mini-debugsource
libcurl4
libcurl-mini4-debuginfo
libcurl4-debuginfo
libcurl-mini4

Install updates from vendor's website.

cURL - update to 8.12.0
EasyApache - update to 4 25-5
SecurityCenter - update to SC-202504.2
LANTIME Operating System Firmware (LTOS) - update to 7.08.021
IBM Automation Decision Services - update to 24.0.0.0.4
curl - update to 8.4.0-7
libcurl - update to 8.4.0-7
curl-minimal - update to 8.4.0-7
curl-doc - update to 8.4.0-7
libcurl-debuginfo - update to 8.4.0-7
libcurl-devel - update to 8.4.0-7
libcurl-minimal - update to 8.4.0-7
curl - update to 8.12.0
libcurl4-64bit - update to 8.14.1-150600.4.28.1
libcurl-devel-64bit - update to 8.14.1-150600.4.28.1
libcurl4-64bit-debuginfo - update to 8.14.1-150600.4.28.1
libcurl4-32bit - update to 8.14.1-150600.4.28.1
libcurl-devel-32bit - update to 8.14.1-150600.4.28.1
libcurl4-32bit-debuginfo - update to 8.14.1-150600.4.28.1
curl-fish-completion - update to 8.14.1-150600.4.28.1
libcurl-devel-doc - update to 8.14.1-150600.4.28.1
curl-zsh-completion - update to 8.14.1-150600.4.28.1
curl-debugsource - update to 8.14.1-150600.4.28.1
curl-debuginfo - update to 8.14.1-150600.4.28.1
curl - update to 8.14.1-150600.4.28.1
curl-mini-debugsource - update to 8.14.1-150600.4.28.1
libcurl4 - update to 8.14.1-150600.4.28.1
libcurl-mini4-debuginfo - update to 8.14.1-150600.4.28.1
libcurl-devel - update to 8.14.1-150600.4.28.1
libcurl4-debuginfo - update to 8.14.1-150600.4.28.1
libcurl-mini4 - update to 8.14.1-150600.4.28.1

• https://curl.se/docs/CVE-2025-0665.html

• Multiple vulnerabilities in cURL
• Slackware Linux update for curl
• Multiple vulnerabilities in cPanel EasyApache
• Anolis OS update for curl
• Tenable Security Center update for third-party components
• Meinberg LANTIME firmware update for third-party components (March 2025)
• Multiple vulnerabilities in IBM Automation Decision Services
• SUSE update for curl