Improper Certificate Validation in cURL - CVE-2025-14819

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU121027

Improper Certificate Validation in cURL - CVE-2025-14819

Published: January 7, 2026


Vulnerability identifier: #VU121027
CSH Severity: Low
CVSS v4 BT: 0.5 [CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: CVE-2025-14819
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to the way libcurl handles TLS transfers when using the CURLSSLOPT_NO_PARTIALCHAIN option. A remote attacker can trick the library into re-using a CA store cached in memory for which the partial chain option was reversed, leading to store policy bypass and a potential MitM attack.


Affected software

cURL
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Ubuntu
Basesystem Module
openSUSE Leap
Anolis OS
openEuler
SecurityCenter
Nessus Network Monitor
LANTIME Operating System Firmware (LTOS)
curl (Ubuntu package)
libcurl4
libcurl4-32bit
libcurl4-debuginfo-32bit
libcurl-devel
curl-debuginfo
curl
libcurl4-debuginfo
curl-debugsource
curl-minimal
libcurl
libcurl-minimal
curl-doc
curl-help
curl-zsh-completion
curl-fish-completion
curl-mini-debugsource
libcurl-devel-doc
libcurl-mini4-debuginfo
libcurl-mini4
libcurl-devel-32bit
libcurl4-32bit-debuginfo
libcurl4-64bit-debuginfo
libcurl4-64bit
libcurl-devel-64bit

How to mitigate CVE-2025-14819

Install updates from vendor's website.

cURL - update to 8.18.0
SecurityCenter - addressed in versions SC-202602.1, SC-202602.2
Nessus Network Monitor - update to 6.5.3
LANTIME Operating System Firmware (LTOS) - update to 7.10.008
curl (Ubuntu package) - addressed in versions 7.35.0-1ubuntu2.20+esm19, 7.47.0-1ubuntu2.19+esm15, 7.58.0-2ubuntu3.24+esm7, 7.68.0-1ubuntu2.25+esm2, 7.81.0-1ubuntu1.22, 8.5.0-2ubuntu10.7, 8.14.1-2ubuntu1.1
libcurl4 - addressed in versions 8.0.1-11.111.1, 8.14.1-150200.4.97.1, 8.14.1-150400.5.77.1, 8.14.1-150600.4.34.1, 8.14.1-150700.7.8.1
libcurl4-32bit - addressed in versions 8.0.1-11.111.1, 8.14.1-150400.5.77.1, 8.14.1-150600.4.34.1, 8.14.1-150700.7.8.1
libcurl4-debuginfo-32bit - update to 8.0.1-11.111.1
libcurl-devel - addressed in versions 8.0.1-11.111.1, 8.14.1-150400.5.77.1, 8.14.1-150600.4.34.1, 8.14.1-150700.7.8.1
curl-debuginfo - addressed in versions 8.0.1-11.111.1, 8.14.1-150200.4.97.1, 8.14.1-150400.5.77.1, 8.14.1-150600.4.34.1, 8.14.1-150700.7.8.1
curl - addressed in versions 8.0.1-11.111.1, 8.14.1-150200.4.97.1, 8.14.1-150400.5.77.1, 8.14.1-150600.4.34.1, 8.14.1-150700.7.8.1
libcurl4-debuginfo - addressed in versions 8.0.1-11.111.1, 8.14.1-150200.4.97.1, 8.14.1-150400.5.77.1, 8.14.1-150600.4.34.1, 8.14.1-150700.7.8.1
curl-debugsource - addressed in versions 8.0.1-11.111.1, 8.14.1-150200.4.97.1, 8.14.1-150400.5.77.1, 8.14.1-150600.4.34.1, 8.14.1-150700.7.8.1
curl - update to 8.4.0-13
curl-minimal - update to 8.4.0-13
libcurl - update to 8.4.0-13
libcurl-devel - update to 8.4.0-13
libcurl-minimal - update to 8.4.0-13
curl-doc - update to 8.4.0-13
curl - update to 8.4.0-26
curl-debuginfo - update to 8.4.0-26
curl-help - update to 8.4.0-26
libcurl-devel - update to 8.4.0-26
curl-debugsource - update to 8.4.0-26
libcurl - update to 8.4.0-26
curl-zsh-completion - addressed in versions 8.14.1-150400.5.77.1, 8.14.1-150600.4.34.1
curl-fish-completion - addressed in versions 8.14.1-150400.5.77.1, 8.14.1-150600.4.34.1
curl-mini-debugsource - addressed in versions 8.14.1-150400.5.77.1, 8.14.1-150600.4.34.1
libcurl-devel-doc - addressed in versions 8.14.1-150400.5.77.1, 8.14.1-150600.4.34.1
libcurl-mini4-debuginfo - addressed in versions 8.14.1-150400.5.77.1, 8.14.1-150600.4.34.1
libcurl-mini4 - addressed in versions 8.14.1-150400.5.77.1, 8.14.1-150600.4.34.1
libcurl-devel-32bit - addressed in versions 8.14.1-150400.5.77.1, 8.14.1-150600.4.34.1
libcurl4-32bit-debuginfo - addressed in versions 8.14.1-150400.5.77.1, 8.14.1-150600.4.34.1, 8.14.1-150700.7.8.1
libcurl4-64bit-debuginfo - addressed in versions 8.14.1-150400.5.77.1, 8.14.1-150600.4.34.1
libcurl4-64bit - addressed in versions 8.14.1-150400.5.77.1, 8.14.1-150600.4.34.1
libcurl-devel-64bit - addressed in versions 8.14.1-150400.5.77.1, 8.14.1-150600.4.34.1

External References

Related Security Bulletins