CVE-2025-0725
gzip integer overflow
When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the CURLOPT_ACCEPT_ENCODING option,
using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would
make libcurl perform a buffer overflow.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
gzip integer overflow
When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the CURLOPT_ACCEPT_ENCODING option,
using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would
make libcurl perform a buffer overflow.
- Record
CVE-2025-0725- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
EUVDEUVD-2025-1837
When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the CURLOPT_ACCEPT_ENCODING option,
using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would
make libcurl perform a buffer overflow.
- Record
EUVD-2025-1837- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vvqh-cqpj-5537
When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses...
When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the CURLOPT_ACCEPT_ENCODING option,
using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would
make libcurl perform a buffer overflow.
- Record
GHSA-vvqh-cqpj-5537- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-120
- Updated
- 2026-11-02
NVD
When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the CURLOPT_ACCEPT_ENCODING option,
using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would
make libcurl perform a buffer overflow.
- Record
CVE-2025-0725- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-120
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-0725
When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the CURLOPT_ACCEPT_ENCODING option,
using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would
make libcurl perform a buffer overflow.
- Record
ALPINE-CVE-2025-0725- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVBELL-CVE-2025-0725
CVE-2025-0725 does not affect BellSoft software
- Record
BELL-CVE-2025-0725- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Show 16 moreShow less
OSV
gzip integer overflow
When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the CURLOPT_ACCEPT_ENCODING option,
using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would
make libcurl perform a buffer overflow.
- Record
CVE-2025-0725- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-0725
When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the CURLOPT_ACCEPT_ENCODING option, using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.
- Record
DEBIAN-CVE-2025-0725- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVJLSEC-2026-422
When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with...
When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the CURLOPT_ACCEPT_ENCODING option,
using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would
make libcurl perform a buffer overflow.
- Record
JLSEC-2026-422- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVROOT-OS-ALPINE-315-CVE-2025-0725
CVE-2025-0725 in curl - Patched by Root
Root has patched CVE-2025-0725 in the curl package for Root:Alpine:3.15. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-315-CVE-2025-0725- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-04
OSVROOT-OS-ALPINE-317-CVE-2025-0725
CVE-2025-0725 in curl - Patched by Root
Root has patched CVE-2025-0725 in the curl package for Root:Alpine:3.17. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-317-CVE-2025-0725- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-04
OSVROOT-OS-DEBIAN-12-CVE-2025-0725
CVE-2025-0725 in curl - Patched by Root
Root has patched CVE-2025-0725 in the curl package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2025-0725- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-04
OSVAZL-56471 No score
CVE-2025-0725 affecting package mysql for versions less than 8.0.40-4
When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the CURLOPT_ACCEPT_ENCODING option,
using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would
make libcurl perform a buffer overflow.
- Record
AZL-56471- Updated
- 2026-11-02
OSVAZL-56498 No score
CVE-2025-0725 affecting package mysql for versions less than 8.0.42-1
When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the CURLOPT_ACCEPT_ENCODING option,
using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would
make libcurl perform a buffer overflow.
- Record
AZL-56498- Updated
- 2026-11-02
OSVAZL-56504 No score
CVE-2025-0725 affecting package curl for versions less than 8.11.1-3
When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the CURLOPT_ACCEPT_ENCODING option,
using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would
make libcurl perform a buffer overflow.
- Record
AZL-56504- Updated
- 2026-11-05
OSVCURL-CVE-2025-0725 No score
gzip integer overflow
When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the CURLOPT_ACCEPT_ENCODING option,
using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would
make libcurl perform a buffer overflow.
- Record
CURL-CVE-2025-0725- Updated
- 2026-11-02
OSVMGASA-2025-0123 No score
Updated curl packages fix security vulnerabilities
When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. The fix was included previously as part of MGAA-2025-0004.
- Record
MGASA-2025-0123- Updated
- 2026-11-02
OSVSUSE-SU-2025:0369-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2025-0725: Fixed gzip integer overflow (bsc#1236590)
- CVE-2025-0167: Fixed netrc and default credential leak (bsc#1236588)
- Record
SUSE-SU-2025:0369-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:0370-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2025-0725: Fixed gzip integer overflow (bsc#1236590)
- CVE-2025-0167: Fixed netrc and default credential leak (bsc#1236588)
- Record
SUSE-SU-2025:0370-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:0371-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2025-0725: Fixed gzip integer overflow (bsc#1236590)
- CVE-2025-0167: Fixed netrc and default credential leak (bsc#1236588)
- Record
SUSE-SU-2025:0371-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:0372-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2025-0725: Fixed gzip integer overflow (bsc#1236590)
- CVE-2025-0167: Fixed netrc and default credential leak (bsc#1236588)
- Record
SUSE-SU-2025:0372-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:20144-1 No score
Security update for curl
This update for curl fixes the following issues:
Security issues fixed:
- CVE-2025-0725: Fixed gzip integer overflow (bsc#1236590)
- CVE-2025-0167: Fixed netrc and default credential leak (bsc#1236588)
Other issues fixed:
- Make sure the TLS handshake after a successful STARTTLS command is fully done before further sending/receiving on the connection. (bsc#1235151)
- Record
SUSE-SU-2025:20144-1- Updated
- 2026-11-02
Affected products
- curl
- haxx curl
- haxx libcurl
- netapp hci baseboard management controller
- netapp hci h610c firmware
- netapp hci h610s firmware
- netapp hci h615c firmware
- netapp solidfire \& hci management node
- netapp solidfire \& hci storage node
- siemens ruggedcom rst2428p
- siemens scalance xc-300/xr-300/xc-400/xr-500wg/xr-500 family
- siemens scalance xch328
Show 16 moreShow less
- siemens scalance xcm324
- siemens scalance xcm328
- siemens scalance xcm332
- siemens scalance xrh334 (24 v dc, 8xfo, cc)
- siemens scalance xrm334 (230 v ac, 12xfo)
- siemens scalance xrm334 (230 v ac, 8xfo)
- siemens scalance xrm334 (230v ac, 2x10g, 24xsfp, 8xsfp+)
- siemens scalance xrm334 (24 v dc, 12xfo)
- siemens scalance xrm334 (24 v dc, 8xfo)
- siemens scalance xrm334 (24v dc, 2x10g, 24xsfp, 8xsfp+)
- siemens scalance xrm334 (2x230 v ac, 12xfo)
- siemens scalance xrm334 (2x230 v ac, 8xfo)
- siemens scalance xrm334 (2x230v ac, 2x10g, 24xsfp, 8xsfp+)
- siemens simatic s7-1500 cpu 1518-4 pn/dp mfp
- siemens simatic s7-1500 cpu 1518f-4 pn/dp mfp
- siemens siplus s7-1500 cpu 1518-4 pn/dp mfp
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlAlpine:v3.18 |
7.10.5 up to 8.12.0-r0 | 8.12.0-r0 |
curlAlpine:v3.19 |
7.10.5 up to 8.12.0-r0 | 8.12.0-r0 |
curlAlpine:v3.20 |
7.10.5 up to 8.12.0-r0 | 8.12.0-r0 |
curlAlpine:v3.21 |
7.10.5 up to 8.12.0-r0 | 8.12.0-r0 |
curlAlpine:v3.22 |
7.10.5 up to 8.12.0-r0 | 8.12.0-r0 |
curlAlpine:v3.23 |
7.10.5 up to 8.12.0-r0 | 8.12.0-r0 |
curlAlpine:v3.24 |
7.10.5 up to 8.12.0-r0 | 8.12.0-r0 |
mysqlAzure Linux:2 |
before 8.0.40-4 | 8.0.40-4 |
mysqlAzure Linux:3 |
before 8.0.42-1 | 8.0.42-1 |
curlAzure Linux:3 |
before 8.11.1-3 | 8.11.1-3 |
Show 35 moreShow less
| Package | Affected | Fixed |
|---|---|---|
curlDebian:12 |
All versions, plus listed versions 7.88.1-107.88.1-10+deb12u17.88.1-10+deb12u117.88.1-10+deb12u127.88.1-10+deb12u13 Show 45 moreShow less7.88.1-10+deb12u147.88.1-10+deb12u157.88.1-10+deb12u1~bpo11+17.88.1-10+deb12u27.88.1-10+deb12u37.88.1-10+deb12u3~bpo11+17.88.1-10+deb12u47.88.1-10+deb12u57.88.1-10+deb12u5~bpo11+17.88.1-10+deb12u67.88.1-10+deb12u6~bpo11+17.88.1-10+deb12u77.88.1-10+deb12u87.88.1-10+deb12u97.88.1-118.0.1-1~exp18.10.0-18.10.0-28.10.1-18.10.1-1~bpo12+18.10.1-28.11.0-18.11.1-18.11.1-1~bpo12+18.12.0+git20250209.89ed161+ds-18.12.0+git20250209.89ed161+ds-1~bpo12+18.12.1-18.12.1-28.12.1-2~bpo12+18.12.1-38.12.1-3~bpo12+18.13.0-18.13.0-1+exp18.13.0-28.13.0-2+exp18.13.0-38.13.0-48.13.0-4+exp18.13.0-58.13.0-5+exp18.13.0-5~bpo12+18.13.0~rc-1~exp18.13.0~rc-1~exp28.13.0~rc2-18.13.0~rc2-2 |
None known |
curlDebian:13 |
before 8.12.0+git20250209.89ed161+ds-1 | 8.12.0+git20250209.89ed161+ds-1 |
curlDebian:14 |
before 8.12.0+git20250209.89ed161+ds-1 | 8.12.0+git20250209.89ed161+ds-1 |
CURL_jllJulia |
before 8.13.0+0 | 8.13.0+0 |
LibCURL_jllJulia |
before 8.12.0+0 | 8.12.0+0 |
curlMageia:9 |
before 7.88.1-4.6.mga9 | 7.88.1-4.6.mga9 |
curlRoot:Alpine:3.15 |
before 8.5.0-r00073 | 8.5.0-r000738.5.0-r000748.5.0-r00075 |
rootio-curlRoot:Alpine:3.15 |
before 8.5.0-r00073 | 8.5.0-r000738.5.0-r000748.5.0-r00075 |
curlRoot:Alpine:3.17 |
before 8.9.0-r00073 | 8.9.0-r000738.9.0-r000748.9.0-r000758.9.0-r000768.9.0-r00077 |
rootio-curlRoot:Alpine:3.17 |
before 8.9.0-r00073 | 8.9.0-r000738.9.0-r000748.9.0-r000758.9.0-r000768.9.0-r00077 |
curlRoot:Debian:12 |
before 7.88.1-10+deb12u14.root.io.11 | 7.88.1-10+deb12u14.root.io.117.88.1-10+deb12u14.root.io.107.88.1-10+deb12u15.aikido.137.88.1-10+deb12u15.aikido.147.88.1-10+deb12u15.aikido.157.88.1-10+deb12u15.aikido.167.88.1-10+deb12u15.aikido.177.88.1-10+deb12u15.aikido.187.88.1-10+deb12u15.aikido.197.88.1-10+deb12u15.aikido.20 |
rootio-curlRoot:Debian:12 |
before 7.88.1-10+deb12u14.root.io.11 | 7.88.1-10+deb12u14.root.io.117.88.1-10+deb12u14.root.io.107.88.1-10+deb12u15.aikido.137.88.1-10+deb12u15.aikido.147.88.1-10+deb12u15.aikido.157.88.1-10+deb12u15.aikido.167.88.1-10+deb12u15.aikido.177.88.1-10+deb12u15.aikido.187.88.1-10+deb12u15.aikido.197.88.1-10+deb12u15.aikido.20 |
curlSUSE:Linux Enterprise Module for Basesystem 15 SP6 |
before 8.6.0-150600.4.21.1 | 8.6.0-150600.4.21.1 |
curlopenSUSE:Leap 15.6 |
before 8.6.0-150600.4.21.1 | 8.6.0-150600.4.21.1 |
curlSUSE:Linux Enterprise Installer Updates 15 SP4 |
before 8.0.1-150400.5.62.1 | 8.0.1-150400.5.62.1 |
curlSUSE:Linux Enterprise Installer Updates 15 SP5 |
before 8.0.1-150400.5.62.1 | 8.0.1-150400.5.62.1 |
curlSUSE:Linux Enterprise Micro 5.3 |
before 8.0.1-150400.5.62.1 | 8.0.1-150400.5.62.1 |
curlSUSE:Linux Enterprise Micro 5.4 |
before 8.0.1-150400.5.62.1 | 8.0.1-150400.5.62.1 |
curlSUSE:Linux Enterprise Micro 5.5 |
before 8.0.1-150400.5.62.1 | 8.0.1-150400.5.62.1 |
curlSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 8.0.1-150400.5.62.1 | 8.0.1-150400.5.62.1 |
curlSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 8.0.1-150400.5.62.1 | 8.0.1-150400.5.62.1 |
curlSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 8.0.1-150400.5.62.1 | 8.0.1-150400.5.62.1 |
curlSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 8.0.1-150400.5.62.1 | 8.0.1-150400.5.62.1 |
curlSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 8.0.1-150400.5.62.1 | 8.0.1-150400.5.62.1 |
curlSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 8.0.1-150400.5.62.1 | 8.0.1-150400.5.62.1 |
curlSUSE:Manager Server 4.3 |
before 8.0.1-150400.5.62.1 | 8.0.1-150400.5.62.1 |
curlSUSE:Linux Enterprise Server 12 SP5-LTSS |
before 8.0.1-11.105.1 | 8.0.1-11.105.1 |
curlSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 8.0.1-11.105.1 | 8.0.1-11.105.1 |
curlSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 7.66.0-150200.4.84.1 | 7.66.0-150200.4.84.1 |
curlSUSE:Linux Enterprise Server 15 SP3-LTSS |
before 7.66.0-150200.4.84.1 | 7.66.0-150200.4.84.1 |
curlSUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 7.66.0-150200.4.84.1 | 7.66.0-150200.4.84.1 |
curlSUSE:Linux Enterprise Micro 5.1 |
before 7.66.0-150200.4.84.1 | 7.66.0-150200.4.84.1 |
curlSUSE:Linux Enterprise Micro 5.2 |
before 7.66.0-150200.4.84.1 | 7.66.0-150200.4.84.1 |
curlSUSE:Enterprise Storage 7.1 |
before 7.66.0-150200.4.84.1 | 7.66.0-150200.4.84.1 |
curlSUSE:Linux Micro 6.0 |
before 8.6.0-6.1 | 8.6.0-6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | OSV | |
| affected, aliases | OSV | |
| affected | OSV | |
| affected, facts | OSV | |
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-0725 is a high vulnerability (CVSS 7.3) in Curl, published February 5, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.80%, the 78th percentile. Fixed in curl 8.12.0-r0.
References
curl.se/docs/CVE-2025-0725.json
hackerone.com/reports/2956023
openwall.com/lists/oss-security/2025/02/05/3
Show 25 moreShow less
security.netapp.com/advisory/ntap-20250306-0009
github.com/curl/curl/commit/76f83f0db23846e254d940ec7
cert-portal.siemens.com/productcert/html/ssa-398330.html
nvd.nist.gov/vuln/detail/CVE-2025-0725
security.alpinelinux.org/vuln/CVE-2025-0725
docs.bell-sw.com/security/cves/CVE-2025-0725
security-tracker.debian.org/tracker/CVE-2025-0725
advisories.mageia.org/MGASA-2025-0123.html
bugs.mageia.org/show_bug.cgi?id=33992
suse.com/support/update/announcement/2025/suse-su-20250369-1
bugzilla.suse.com/1236588
Left out here: 137 versions. The JSON record has them.