Improper certificate validation in messagelib - CVE-2025-69412
Published: January 7, 2026
Vulnerability identifier: #VU121034
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2025-69412
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to software ignores SSL errors when contacting the Google Safe Browsing API. A remote attacker can perform MitM attack and manipulate traffic between the applications using messagelib (KMail, Akregator, etc) and the Google Safe Browsing service.
Note, Google Safe Browsing API is disabled by default.
Affected software
messagelib
openEuler
kf5-messagelib
kf5-messagelib-debuginfo
kf5-messagelib-debugsource
kf5-messagelib-devel
openEuler
kf5-messagelib
kf5-messagelib-debuginfo
kf5-messagelib-debugsource
kf5-messagelib-devel
How to mitigate CVE-2025-69412
Install updates from vendor's website.
messagelib - update to 25.12.0
kf5-messagelib - update to 23.08.4-3
kf5-messagelib-debuginfo - update to 23.08.4-3
kf5-messagelib-debugsource - update to 23.08.4-3
kf5-messagelib-devel - update to 23.08.4-3
kf5-messagelib - update to 23.08.4-3
kf5-messagelib-debuginfo - update to 23.08.4-3
kf5-messagelib-debugsource - update to 23.08.4-3
kf5-messagelib-devel - update to 23.08.4-3