BaseFortify

Publication date: 2025-11-07

Last updated on: 2026-06-02

Assigner: curl

Description

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-07

Last Modified

2026-06-02

Generated

2026-07-06

AI Q&A

2025-11-07

EPSS Evaluated

2026-07-05

NVD

CVE-2025-10966

Affected Vendors & Products

Vendor	Product	Version / Range
curl	curl	7.69.0
curl	curl	8.16.0
curl	curl	8.17.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

The vulnerability is in curl's code for managing SSH connections when using the wolfSSH powered backend for SFTP. The code missed host verification mechanisms, which means curl cannot properly verify the identity of the SSH server it connects to. This flaw prevents curl from detecting man-in-the-middle (MITM) attackers and other related security issues.

Impact Analysis

This vulnerability can allow attackers to perform man-in-the-middle (MITM) attacks during SFTP connections made by curl using the wolfSSH backend. Because host verification is missing, an attacker could intercept or alter data transmitted over the SSH connection without detection, potentially leading to data compromise or unauthorized access.

Hi! I’m here to help you understand CVE-2025-10966. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70