CVE-2025-15079

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file.

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file.

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.(CVE-2025-14524)

When doing TLS related transfers with reused easy or multi handles and altering the CURLSSLOPT_NO_PARTIALCHAIN option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.(CVE-2025-14819)

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file.(CVE-2025-15079)

When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.(CVE-2025-15224)

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.(CVE-2025-14524)

When doing TLS related transfers with reused easy or multi handles and altering the CURLSSLOPT_NO_PARTIALCHAIN option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.(CVE-2025-14819)

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file.(CVE-2025-15079)

When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.(CVE-2025-15224)

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.(CVE-2025-14524)

When doing TLS related transfers with reused easy or multi handles and altering the CURLSSLOPT_NO_PARTIALCHAIN option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.(CVE-2025-14819)

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file.(CVE-2025-15079)

When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.(CVE-2025-15224)

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.(CVE-2025-14524)

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file.(CVE-2025-15079)

When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.(CVE-2025-15224)

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.(CVE-2025-14524)

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file.(CVE-2025-15079)

When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.(CVE-2025-15224)

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.(CVE-2025-14524)

When doing TLS related transfers with reused easy or multi handles and altering the CURLSSLOPT_NO_PARTIALCHAIN option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.(CVE-2025-14819)

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file.(CVE-2025-15079)

When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.(CVE-2025-15224)

Root has patched CVE-2025-15079 in the curl package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-15079 in the curl package for Root:Debian:13. Multiple fixed versions available.

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file.

• CVE-2025-15079: fix accepting hosts not present in the specified known_hosts during SSH-based SCP/SFTP transfers when global known_hosts contained them restrict host verification to the specified known_hosts file

• CVE-2025-15079: fix accepting hosts not present in the specified known_hosts during SSH-based SCP/SFTP transfers when global known_hosts contained them restrict host verification to the specified known_hosts file

• CVE-2025-14524: prevent bearer token leak on cross-protocol redirect
• CVE-2025-15079: set both SSH knownhosts options to the same file to prevent libssh global known_hosts override

• CVE-2025-14524: prevent bearer token leak on cross-protocol redirect
• CVE-2025-15079: set both SSH knownhosts options to the same file to prevent libssh global known_hosts override

• CVE-2025-15079: libssh global known_hosts file override
• CVE-2025-14524: bearer token leak on cross-protocol redirect

• SECURITY UPDATE: acceptance of hosts not listed in specified known_hosts file during SSH-based transfers
  • debian/patches/CVE-2025-15079.patch: Set both knownhosts options to same file and fix surprises caused by libssh exposing separate KNOWNHOSTS and GLOBAL_KNOWNHOSTS options.
  • CVE-2025-15079
• Regenerate Server-localhost-lastSAN-sv test certificate with SHA-256
  • debian/patches/regenerate-lastSAN-cert-sha256.patch: Fix "ca md too weak" error with OpenSSL 1.1.1+ by replacing SHA-1 signed certificate with SHA-256. Also fixes Makefile.am bug for lastSAN target.
• Update failed test
  • debian/patches/26_CVE-2021-22876.patch: Update test to avoid using unsupported commands
• Update failed test
  • debian/patches/fix-test323-errorcode.patch: two valid error codes now
• Disable some tests
  • debian/rules: add option to disable tests marked as flaky, fail the build if any test fails
  • debian/patches/add-flaky-to-test1592.patch: mark test1592 as flaky
  • debian/patches/disable-nss-failing-tests.patch: libnsspem.so is not available on Debian 10
• Remove unsupported test:
  • debian/patches/test8-verify-that-ctrl-byte-cookies-are-ignored.patch: no ctrl-byte-cookies are supported

• SECURITY UPDATE: OAuth2 bearer token leak on cross-protocol redirect
  • debian/patches/CVE-2025-14524.patch: do not use bearer when following redirect unless allow_auth_to_other_hosts is set
  • CVE-2025-14524
• SECURITY UPDATE: libssh global known_hosts override
  • debian/patches/CVE-2025-15079.patch: set SSH_OPTIONS_GLOBAL_KNOWNHOSTS to same path as SSH_OPTIONS_KNOWNHOSTS
  • CVE-2025-15079
• Resolve test failure
  • debian/patches/fix-test-46.patch: updated outdated cookies' timestamps

• SECURITY UPDATE: OAuth2 bearer token leak on cross-protocol redirect
  • debian/patches/CVE-2025-14524.patch: do not use bearer when following redirect unless allow_auth_to_other_hosts is set
  • CVE-2025-14524
• SECURITY UPDATE: libssh global known_hosts override
  • debian/patches/CVE-2025-15079-CVE-2025-15224.patch: set SSH_OPTIONS_GLOBAL_KNOWNHOSTS to same path as SSH_OPTIONS_KNOWNHOSTS
  • CVE-2025-15079
• SECURITY UPDATE: libssh key passphrase bypass without agent set
  • debian/patches/CVE-2025-15079-CVE-2025-15224.patch: require private key or CURLSSH_AUTH_AGENT for public key auth
  • CVE-2025-15224

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file.

curl is susceptible to a number of low severity security vulnerabilities: CVE-2025-14524: bearer token leak on cross-protocol redirect CVE-2025-14819: OpenSSL partial chain store policy bypass CVE-2025-15079: libssh knownhosts file vulnerability CVE-2025-15224: libssh key passphrase bypass vulnerability This release fixes these issues.

These are all security issues fixed in the curl-8.18.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for curl fixes the following issues:

This update for curl fixes the following issues:

• CVE-2025-14017: broken TLS options for threaded LDAPS (bsc#1256105).
• CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
• CVE-2025-14819: libssh global knownhost override (bsc#1255732).
• CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
• CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

This update for curl fixes the following issues:

• CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
• CVE-2025-14819: libssh global knownhost override (bsc#1255732).
• CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
• CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

This update for curl fixes the following issues:

• CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
• CVE-2025-14819: libssh global knownhost override (bsc#1255732).
• CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
• CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

This update for curl fixes the following issues:

• CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
• CVE-2025-14819: libssh global knownhost override (bsc#1255732).
• CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
• CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

This update for curl fixes the following issues:

• CVE-2025-14524: Fixed bearer token leak on cross-protocol redirect (bsc#1255731)
• CVE-2025-15079: Fixed unknown host connection acceptance when set in the global knownhostsfile (bsc#1255733)
• CVE-2025-14819: Fixed issue where alteration of CURLSSLOPT_NO_PARTIALCHAIN could accidentally lead to CA cache reuse for which partial chain was reversed (bsc#1255732)

This update for curl fixes the following issues:

• CVE-2025-14017: Fixed broken TLS options for threaded LDAPS (bsc#1256105).
• CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
• CVE-2025-14819: libssh global knownhost override (bsc#1255732).
• CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
• CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

This update for curl fixes the following issues:

• CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
• CVE-2025-14819: libssh global knownhost override (bsc#1255732).
• CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
• CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

This update for curl fixes the following issues:

• CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
• CVE-2025-14819: libssh global knownhost override (bsc#1255732).
• CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
• CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

This update for curl fixes the following issues:

This update for curl fixes the following issues:

• CVE-2025-14017: broken TLS options for threaded LDAPS (bsc#1256105).
• CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
• CVE-2025-14819: libssh global knownhost override (bsc#1255732).
• CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
• CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

This update for curl fixes the following issues:

This update for curl fixes the following issues:

• CVE-2025-14017: broken TLS options for threaded LDAPS (bsc#1256105).
• CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
• CVE-2025-14819: libssh global knownhost override (bsc#1255732).
• CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
• CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

It was discovered that curl incorrectly handled cookies when redirected from secure to insecure connections. An attacker could possibly use this issue to cause a denial of service, or obtain sensitive information. This issue only affected Ubuntu 25.10. (CVE-2025-9086)

Calvin Ruocco discovered that curl did not properly handle WebSocket communications under certain circumstances. A malicious server could possibly use this issue to poison proxy caches with malicious content. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-10148)

Stanislav Fort discovered that wcurl did not properly handle URLs with certain encoded characters. If a user were tricked into processing a specially crafted URL, an attacker could possibly use this issue to write files outside the intended directory. This issue only affected Ubuntu 25.10. (CVE-2025-11563)

Stanislav Fort discovered that curl did not properly validate pinned public keys under certain circumstances. A remote attacker could possibly use this issue to perform a machine-in-the-middle attack. This issue only affected Ubuntu 25.10.(CVE-2025-13034)

Stanislav Fort discovered that curl did not properly manage TLS options when performing LDAP over TLS transfers in multi-threaded environments. Under certain circumstances, certificate verification could be unintentionally and unknowingly disabled. (CVE-2025-14017)

It was discovered that curl incorrectly handled Oauth2 bearer tokens when following redirects. A remote attacker could possibly use this issue to obtain authentication credentials. (CVE-2025-14524)

Stanislav Fort discovered that curl did not properly validate TLS certificates when reusing connections. A remote attacker could possibly use this issue to bypass expected certificate verification. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-14819)

Harry Sintonen discovered that curl did not properly validate SSH host keys when performing SSH-based file transfers. This issue could lead to unintended bypass of custom known_hosts file. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-15079)

Harry Sintonen discovered that curl built with libssh did not properly handle authentication when performing SSH-based file transfers. This could result in unintended authentication operations. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-15224)