CVE-2025-10966
missing SFTP host verification with wolfSSH
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.
This prevents curl from detecting MITM attackers and more.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
missing SFTP host verification with wolfSSH
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.
This prevents curl from detecting MITM attackers and more.
- Record
CVE-2025-10966- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-322
- Updated
- 2026-11-02
EUVDEUVD-2025-38240
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.
This prevents curl from detecting MITM attackers and more.
- Record
EUVD-2025-38240- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5gff-h54g-38r2
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was...
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.
This prevents curl from detecting MITM attackers and more.
- Record
GHSA-5gff-h54g-38r2- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-322
- Updated
- 2026-11-02
NVD
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.
This prevents curl from detecting MITM attackers and more.
- Record
CVE-2025-10966- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-322
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-10966
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.
This prevents curl from detecting MITM attackers and more.
- Record
ALPINE-CVE-2025-10966- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVBELL-CVE-2025-10966
- Record
BELL-CVE-2025-10966- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 10 moreShow less
OSV
missing SFTP host verification with wolfSSH
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.
This prevents curl from detecting MITM attackers and more.
- Record
CVE-2025-10966- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-322
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-10966
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.
- Record
DEBIAN-CVE-2025-10966- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVJLSEC-2026-424
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was...
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.
This prevents curl from detecting MITM attackers and more.
- Record
JLSEC-2026-424- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2026:6893
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:6893- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2025-10966
CVE-2025-10966 in curl - Patched by Root
Root has patched CVE-2025-10966 in the curl package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2025-10966- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-04
OSVROOT-OS-DEBIAN-13-CVE-2025-10966
CVE-2025-10966 in curl - Patched by Root
Root has patched CVE-2025-10966 in the curl package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2025-10966- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
OSVAZL-69748 No score
CVE-2025-10966 affecting package cmake for versions less than 3.30.3-12
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.
This prevents curl from detecting MITM attackers and more.
- Record
AZL-69748- Updated
- 2026-11-05
OSVAZL-69766 No score
CVE-2025-10966 affecting package cmake 3.21.4-21
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.
This prevents curl from detecting MITM attackers and more.
- Record
AZL-69766- Updated
- 2026-11-02
OSVCURL-CVE-2025-10966 No score
missing SFTP host verification with wolfSSH
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.
This prevents curl from detecting MITM attackers and more.
- Record
CURL-CVE-2025-10966- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15757-1 No score
curl-8.17.0-1.1 on GA media
These are all security issues fixed in the curl-8.17.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15757-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlAlpine:v3.23 |
7.69.0 up to 8.17.0-r0 | 8.17.0-r0 |
curlAlpine:v3.24 |
7.69.0 up to 8.17.0-r0 | 8.17.0-r0 |
cmakeAzure Linux:3 |
before 3.30.3-12 | 3.30.3-12 |
cmakeAzure Linux:2 |
through 3.21.4-21 | None known |
curlAlpaquita:23 |
8.1.0-r2 up to 8.9.1-r4 | 8.9.1-r4 |
curlAlpaquita:25 |
8.14.0-r1 up to 8.14.1-r3 | 8.14.1-r3 |
curlAlpaquita:stream |
8.1.2-r0 up to 8.17.0-r0 | 8.17.0-r0 |
curlBellSoft Hardened Containers:stream |
8.1.2-r0 up to 8.17.0-r0 | 8.17.0-r0 |
curlDebian:12 |
All versions, plus listed versions 7.88.1-107.88.1-10+deb12u17.88.1-10+deb12u117.88.1-10+deb12u127.88.1-10+deb12u13 Show 45 moreShow less7.88.1-10+deb12u147.88.1-10+deb12u157.88.1-10+deb12u1~bpo11+17.88.1-10+deb12u27.88.1-10+deb12u37.88.1-10+deb12u3~bpo11+17.88.1-10+deb12u47.88.1-10+deb12u57.88.1-10+deb12u5~bpo11+17.88.1-10+deb12u67.88.1-10+deb12u6~bpo11+17.88.1-10+deb12u77.88.1-10+deb12u87.88.1-10+deb12u97.88.1-118.0.1-1~exp18.10.0-18.10.0-28.10.1-18.10.1-1~bpo12+18.10.1-28.11.0-18.11.1-18.11.1-1~bpo12+18.12.0+git20250209.89ed161+ds-18.12.0+git20250209.89ed161+ds-1~bpo12+18.12.1-18.12.1-28.12.1-2~bpo12+18.12.1-38.12.1-3~bpo12+18.13.0-18.13.0-1+exp18.13.0-28.13.0-2+exp18.13.0-38.13.0-48.13.0-4+exp18.13.0-58.13.0-5+exp18.13.0-5~bpo12+18.13.0~rc-1~exp18.13.0~rc-1~exp28.13.0~rc2-18.13.0~rc2-2 |
None known |
curlDebian:13 |
All versions, plus listed versions 8.14.1-28.14.1-2+deb13u18.14.1-2+deb13u28.14.1-2+deb13u2~bpo13+18.14.1-2+deb13u3 Show 45 moreShow less8.14.1-2+deb13u48.14.1-2+deb13u58.14.1-2+deb13u78.14.1-2+exp18.15.0-18.15.0-1~bpo13+18.15.0-1~exp18.15.0~rc1-1exp18.15.0~rc2-1~exp18.15.0~rc3-1~exp18.16.0-18.16.0-1+exp18.16.0-1~bpo13+18.16.0-28.16.0-38.16.0-48.16.0-4~bpo13+18.16.0~rc1-1~exp18.16.0~rc2-18.16.0~rc2-28.16.0~rc3-18.17.0-18.17.0-28.17.0-38.17.0~rc1-1~exp18.17.0~rc2-18.17.0~rc3-18.18.0-18.18.0-1~bpo13+18.18.0-28.18.0~rc1-1+exp18.18.0~rc2-18.18.0~rc3-18.19.0-18.19.0-1+exp18.19.0-1~bpo13+18.19.0-28.19.0-38.19.0-3+exp18.19.0-3+exp28.19.0~rc1-1~exp18.19.0~rc2-18.19.0~rc2-28.19.0~rc3-18.20.0-1 |
None known |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
curlDebian:14 |
before 8.17.0~rc2-1, plus listed versions 8.14.1-28.14.1-2+exp18.15.0-18.15.0-1~bpo13+18.15.0-1~exp1 Show 15 moreShow less8.15.0~rc1-1exp18.15.0~rc2-1~exp18.15.0~rc3-1~exp18.16.0-18.16.0-1+exp18.16.0-1~bpo13+18.16.0-28.16.0-38.16.0-48.16.0-4~bpo13+18.16.0~rc1-1~exp18.16.0~rc2-18.16.0~rc2-28.16.0~rc3-18.17.0~rc1-1~exp1 |
8.17.0~rc2-1 |
CURL_jllJulia |
before 8.17.0+0 | 8.17.0+0 |
LibCURL_jllJulia |
7.70.0+0 up to 8.17.0+0 | 8.17.0+0 |
curlRed Hat:hummingbird:1 From an advisory covering 13 CVEs |
before 0:8.19.0-3.hum1 | 0:8.19.0-3.hum1 |
libcurlRed Hat:hummingbird:1 From an advisory covering 13 CVEs |
before 0:8.19.0-3.hum1 | 0:8.19.0-3.hum1 |
libcurl-develRed Hat:hummingbird:1 From an advisory covering 13 CVEs |
before 0:8.19.0-3.hum1 | 0:8.19.0-3.hum1 |
libcurl-minimalRed Hat:hummingbird:1 From an advisory covering 13 CVEs |
before 0:8.19.0-3.hum1 | 0:8.19.0-3.hum1 |
curlRoot:Debian:12 |
before 7.88.1-10+deb12u14.root.io.11 | 7.88.1-10+deb12u14.root.io.117.88.1-10+deb12u14.root.io.107.88.1-10+deb12u15.aikido.137.88.1-10+deb12u15.aikido.147.88.1-10+deb12u15.aikido.157.88.1-10+deb12u15.aikido.167.88.1-10+deb12u15.aikido.177.88.1-10+deb12u15.aikido.187.88.1-10+deb12u15.aikido.197.88.1-10+deb12u15.aikido.20 |
rootio-curlRoot:Debian:12 |
before 7.88.1-10+deb12u14.root.io.11 | 7.88.1-10+deb12u14.root.io.117.88.1-10+deb12u14.root.io.107.88.1-10+deb12u15.aikido.137.88.1-10+deb12u15.aikido.147.88.1-10+deb12u15.aikido.157.88.1-10+deb12u15.aikido.167.88.1-10+deb12u15.aikido.177.88.1-10+deb12u15.aikido.187.88.1-10+deb12u15.aikido.197.88.1-10+deb12u15.aikido.20 |
curlRoot:Debian:13 |
before 8.14.1-2+deb13u7.aikido.24 | 8.14.1-2+deb13u7.aikido.248.14.1-2+deb13u7.aikido.25 |
rootio-curlRoot:Debian:13 |
before 8.14.1-2+deb13u7.aikido.24 | 8.14.1-2+deb13u7.aikido.248.14.1-2+deb13u7.aikido.25 |
curlopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 8.17.0-1.1 | 8.17.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected, facts | OSV | |
| affected | OSV | |
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-10966 is a medium vulnerability (CVSS 4.3) in Curl, published November 5, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in curl 8.17.0-r0.
References
curl.se/docs/CVE-2025-10966.json
hackerone.com/reports/3355218
openwall.com/lists/oss-security/2025/11/05/2
cert-portal.siemens.com/productcert/html/ssa-253495.html
nvd.nist.gov/vuln/detail/CVE-2025-10966
Show 88 moreShow less
github.com/advisories/GHSA-5gff-h54g-38r2
security.alpinelinux.org/vuln/CVE-2025-10966
docs.bell-sw.com/security/cves/CVE-2025-10966
security-tracker.debian.org/tracker/CVE-2025-10966
access.redhat.com/errata/RHSA-2026:6893
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6893.json
bugzilla.redhat.com/show_bug.cgi?id=2394750
cve.org/CVERecord?id=CVE-2025-9086
suse.com/security/cve/CVE-2025-10966
Left out here: 175 versions. The JSON record has them.