Resource management error in cURL - CVE-2025-0665

Vulnerability identifier: #VU103647

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2025-0665

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
cURL
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Slackware Linux
Basesystem Module
openSUSE Leap
Anolis OS
EasyApache
IBM Automation Decision Services
SecurityCenter
LANTIME Operating System Firmware (LTOS)
curl
libcurl
curl-minimal
curl-doc
libcurl-debuginfo
libcurl-devel
libcurl-minimal
libcurl4-64bit
libcurl-devel-64bit
libcurl4-64bit-debuginfo
libcurl4-32bit
libcurl-devel-32bit
libcurl4-32bit-debuginfo
curl-fish-completion
libcurl-devel-doc
curl-zsh-completion
curl-debugsource
curl-debuginfo
curl-mini-debugsource
libcurl4
libcurl-mini4-debuginfo
libcurl4-debuginfo
libcurl-mini4

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when built with the threaded resolver. A remote attacker can force the application to wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve

Install updates from vendor's website.

• https://curl.se/docs/CVE-2025-0665.html