CVE-2025-14819

When doing TLS related transfers with reused easy or multi handles and altering the CURLSSLOPT_NO_PARTIALCHAIN option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.

When doing TLS related transfers with reused easy or multi handles and altering the CURLSSLOPT_NO_PARTIALCHAIN option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.

When doing TLS related transfers with reused easy or multi handles and altering the CURLSSLOPT_NO_PARTIALCHAIN option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.(CVE-2025-14524)

When doing TLS related transfers with reused easy or multi handles and altering the CURLSSLOPT_NO_PARTIALCHAIN option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.(CVE-2025-14819)

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file.(CVE-2025-15079)

When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.(CVE-2025-15224)

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.(CVE-2025-14524)

When doing TLS related transfers with reused easy or multi handles and altering the CURLSSLOPT_NO_PARTIALCHAIN option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.(CVE-2025-14819)

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file.(CVE-2025-15079)

When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.(CVE-2025-15224)

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.(CVE-2025-14524)

When doing TLS related transfers with reused easy or multi handles and altering the CURLSSLOPT_NO_PARTIALCHAIN option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.(CVE-2025-14819)

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file.(CVE-2025-15079)

When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.(CVE-2025-15224)

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.(CVE-2025-14524)

When doing TLS related transfers with reused easy or multi handles and altering the CURLSSLOPT_NO_PARTIALCHAIN option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.(CVE-2025-14819)

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file.(CVE-2025-15079)

When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.(CVE-2025-15224)

Root has patched CVE-2025-14819 in the rootio-curl package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-14819 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available.

When doing TLS related transfers with reused easy or multi handles and altering the CURLSSLOPT_NO_PARTIALCHAIN option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.

When doing TLS related transfers with reused easy or multi handles and altering the CURLSSLOPT_NO_PARTIALCHAIN option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.

curl is susceptible to a number of low severity security vulnerabilities: CVE-2025-14524: bearer token leak on cross-protocol redirect CVE-2025-14819: OpenSSL partial chain store policy bypass CVE-2025-15079: libssh knownhosts file vulnerability CVE-2025-15224: libssh key passphrase bypass vulnerability This release fixes these issues.

These are all security issues fixed in the curl-8.18.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for curl fixes the following issues:

This update for curl fixes the following issues:

• CVE-2025-14017: broken TLS options for threaded LDAPS (bsc#1256105).
• CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
• CVE-2025-14819: libssh global knownhost override (bsc#1255732).
• CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
• CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

This update for curl fixes the following issues:

• CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
• CVE-2025-14819: libssh global knownhost override (bsc#1255732).
• CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
• CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

This update for curl fixes the following issues:

• CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
• CVE-2025-14819: libssh global knownhost override (bsc#1255732).
• CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
• CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

This update for curl fixes the following issues:

• CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
• CVE-2025-14819: libssh global knownhost override (bsc#1255732).
• CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
• CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

This update for curl fixes the following issues:

• CVE-2025-14524: Fixed bearer token leak on cross-protocol redirect (bsc#1255731)
• CVE-2025-15079: Fixed unknown host connection acceptance when set in the global knownhostsfile (bsc#1255733)
• CVE-2025-14819: Fixed issue where alteration of CURLSSLOPT_NO_PARTIALCHAIN could accidentally lead to CA cache reuse for which partial chain was reversed (bsc#1255732)

This update for curl fixes the following issues:

• CVE-2025-14017: Fixed broken TLS options for threaded LDAPS (bsc#1256105).
• CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
• CVE-2025-14819: libssh global knownhost override (bsc#1255732).
• CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
• CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

This update for curl fixes the following issues:

• CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
• CVE-2025-14819: libssh global knownhost override (bsc#1255732).
• CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
• CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

This update for curl fixes the following issues:

• CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
• CVE-2025-14819: libssh global knownhost override (bsc#1255732).
• CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
• CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

This update for curl fixes the following issues:

This update for curl fixes the following issues:

• CVE-2025-14017: broken TLS options for threaded LDAPS (bsc#1256105).
• CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
• CVE-2025-14819: libssh global knownhost override (bsc#1255732).
• CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
• CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

This update for curl fixes the following issues:

This update for curl fixes the following issues:

• CVE-2025-14017: broken TLS options for threaded LDAPS (bsc#1256105).
• CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
• CVE-2025-14819: libssh global knownhost override (bsc#1255732).
• CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
• CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

It was discovered that curl incorrectly handled cookies when redirected from secure to insecure connections. An attacker could possibly use this issue to cause a denial of service, or obtain sensitive information. This issue only affected Ubuntu 25.10. (CVE-2025-9086)

Calvin Ruocco discovered that curl did not properly handle WebSocket communications under certain circumstances. A malicious server could possibly use this issue to poison proxy caches with malicious content. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-10148)

Stanislav Fort discovered that wcurl did not properly handle URLs with certain encoded characters. If a user were tricked into processing a specially crafted URL, an attacker could possibly use this issue to write files outside the intended directory. This issue only affected Ubuntu 25.10. (CVE-2025-11563)

Stanislav Fort discovered that curl did not properly validate pinned public keys under certain circumstances. A remote attacker could possibly use this issue to perform a machine-in-the-middle attack. This issue only affected Ubuntu 25.10.(CVE-2025-13034)

Stanislav Fort discovered that curl did not properly manage TLS options when performing LDAP over TLS transfers in multi-threaded environments. Under certain circumstances, certificate verification could be unintentionally and unknowingly disabled. (CVE-2025-14017)

It was discovered that curl incorrectly handled Oauth2 bearer tokens when following redirects. A remote attacker could possibly use this issue to obtain authentication credentials. (CVE-2025-14524)

Stanislav Fort discovered that curl did not properly validate TLS certificates when reusing connections. A remote attacker could possibly use this issue to bypass expected certificate verification. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-14819)

Harry Sintonen discovered that curl did not properly validate SSH host keys when performing SSH-based file transfers. This issue could lead to unintended bypass of custom known_hosts file. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-15079)

Harry Sintonen discovered that curl built with libssh did not properly handle authentication when performing SSH-based file transfers. This could result in unintended authentication operations. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-15224)