CVE-2025-10966
Modified Modified - Updated After Analysis
BaseFortify

Publication date: 2025-11-07

Last updated on: 2026-06-02

Assigner: curl

Description
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-07
Last Modified
2026-06-02
Generated
2026-06-16
AI Q&A
2025-11-07
EPSS Evaluated
2026-06-15
NVD
CVE-2025-10966
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
curl curl 7.69.0
curl curl 8.16.0
curl curl 8.17.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability is in curl's code for managing SSH connections when using the wolfSSH powered backend for SFTP. The code missed host verification mechanisms, which means curl cannot properly verify the identity of the SSH server it connects to. This flaw prevents curl from detecting man-in-the-middle (MITM) attackers and other related security issues.

Impact Analysis

This vulnerability can allow attackers to perform man-in-the-middle (MITM) attacks during SFTP connections made by curl using the wolfSSH backend. Because host verification is missing, an attacker could intercept or alter data transmitted over the SSH connection without detection, potentially leading to data compromise or unauthorized access.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-10966. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart