CVE-2025-10966
BaseFortify
Publication date: 2025-11-07
Last updated on: 2025-11-12
Assigner: curl
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| curl | curl | 7.69.0 |
| curl | curl | 8.16.0 |
| curl | curl | 8.17.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability is in curl's code for managing SSH connections when using the wolfSSH powered backend for SFTP. The code missed host verification mechanisms, which means curl cannot properly verify the identity of the SSH server it connects to. This flaw prevents curl from detecting man-in-the-middle (MITM) attackers and other related security issues.
How can this vulnerability impact me? :
This vulnerability can allow attackers to perform man-in-the-middle (MITM) attacks during SFTP connections made by curl using the wolfSSH backend. Because host verification is missing, an attacker could intercept or alter data transmitted over the SSH connection without detection, potentially leading to data compromise or unauthorized access.