{"id":"CVE-2025-0725","aliases":["ALPINE-CVE-2025-0725","AZL-56471","AZL-56498","AZL-56504","BELL-CVE-2025-0725","CURL-CVE-2025-0725","DEBIAN-CVE-2025-0725","EUVD-2025-1837","GHSA-vvqh-cqpj-5537","JLSEC-2026-422","MGASA-2025-0123","ROOT-OS-ALPINE-315-CVE-2025-0725","ROOT-OS-ALPINE-317-CVE-2025-0725","ROOT-OS-DEBIAN-12-CVE-2025-0725","SUSE-SU-2025:0369-1","SUSE-SU-2025:0370-1","SUSE-SU-2025:0371-1","SUSE-SU-2025:0372-1","SUSE-SU-2025:20144-1"],"status":"published","title":"gzip integer overflow","description":"When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.01801,"percentile":0.78794,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120"],"published":"2025-02-05T08:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["8.12.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["8.12.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["8.12.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["8.12.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["8.12.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.12.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.12.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"mysql","fixed_in":["8.0.40-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"mysql","fixed_in":["8.0.42-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"curl","fixed_in":["8.11.1-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["8.12.0+git20250209.89ed161+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.12.0+git20250209.89ed161+ds-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.13.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.12.0+0"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"curl","fixed_in":["8.5.0-r00073","8.5.0-r00074","8.5.0-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"rootio-curl","fixed_in":["8.5.0-r00073","8.5.0-r00074","8.5.0-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.17","package":"curl","fixed_in":["8.9.0-r00073","8.9.0-r00074","8.9.0-r00075","8.9.0-r00076","8.9.0-r00077"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.17","package":"rootio-curl","fixed_in":["8.9.0-r00073","8.9.0-r00074","8.9.0-r00075","8.9.0-r00076","8.9.0-r00077"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"curl","fixed_in":["7.88.1-10+deb12u14.root.io.11","7.88.1-10+deb12u14.root.io.10","7.88.1-10+deb12u15.aikido.13","7.88.1-10+deb12u15.aikido.14","7.88.1-10+deb12u15.aikido.15","7.88.1-10+deb12u15.aikido.16","7.88.1-10+deb12u15.aikido.17","7.88.1-10+deb12u15.aikido.18","7.88.1-10+deb12u15.aikido.19","7.88.1-10+deb12u15.aikido.20"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-curl","fixed_in":["7.88.1-10+deb12u14.root.io.11","7.88.1-10+deb12u14.root.io.10","7.88.1-10+deb12u15.aikido.13","7.88.1-10+deb12u15.aikido.14","7.88.1-10+deb12u15.aikido.15","7.88.1-10+deb12u15.aikido.16","7.88.1-10+deb12u15.aikido.17","7.88.1-10+deb12u15.aikido.18","7.88.1-10+deb12u15.aikido.19","7.88.1-10+deb12u15.aikido.20"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.10.5"},{"fixed":"8.12.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.10.5"},{"fixed":"8.12.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.10.5"},{"fixed":"8.12.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.10.5"},{"fixed":"8.12.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.10.5"},{"fixed":"8.12.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.10.5"},{"fixed":"8.12.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.10.5"},{"fixed":"8.12.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.40-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.42-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.1-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.88.1-10","7.88.1-10+deb12u1","7.88.1-10+deb12u11","7.88.1-10+deb12u12","7.88.1-10+deb12u13","7.88.1-10+deb12u14","7.88.1-10+deb12u15","7.88.1-10+deb12u1~bpo11+1","7.88.1-10+deb12u2","7.88.1-10+deb12u3","7.88.1-10+deb12u3~bpo11+1","7.88.1-10+deb12u4","7.88.1-10+deb12u5","7.88.1-10+deb12u5~bpo11+1","7.88.1-10+deb12u6","7.88.1-10+deb12u6~bpo11+1","7.88.1-10+deb12u7","7.88.1-10+deb12u8","7.88.1-10+deb12u9","7.88.1-11","8.0.1-1~exp1","8.10.0-1","8.10.0-2","8.10.1-1","8.10.1-1~bpo12+1","8.10.1-2","8.11.0-1","8.11.1-1","8.11.1-1~bpo12+1","8.12.0+git20250209.89ed161+ds-1","8.12.0+git20250209.89ed161+ds-1~bpo12+1","8.12.1-1","8.12.1-2","8.12.1-2~bpo12+1","8.12.1-3","8.12.1-3~bpo12+1","8.13.0-1","8.13.0-1+exp1","8.13.0-2","8.13.0-2+exp1","8.13.0-3","8.13.0-4","8.13.0-4+exp1","8.13.0-5","8.13.0-5+exp1","8.13.0-5~bpo12+1","8.13.0~rc-1~exp1","8.13.0~rc-1~exp2","8.13.0~rc2-1","8.13.0~rc2-2","8.13.0~rc3-1","8.13.0~rc3-1+exp1","8.14.0-1","8.14.0-1+exp1","8.14.0~rc1-1+exp1","8.14.0~rc2-1+exp1","8.14.0~rc3-1+exp1","8.14.1-1","8.14.1-1~bpo12+1","8.14.1-2","8.14.1-2+exp1","8.14.1-2~bpo12+1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.2.1-1","8.2.1-2","8.2.1-2~bpo12+1","8.20.0-1","8.20.0-1+exp","8.20.0-2","8.20.0-2+exp1","8.20.0-2~bpo13+1","8.20.0-3","8.20.0-4","8.20.0-5","8.20.0-5~bpo13+1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1","8.20.0~rc3-1","8.20.0~rc3-1+exp1","8.21.0-1","8.21.0-1+exp1","8.21.0-2","8.21.0-2+exp1","8.21.0-2~bpo13+1","8.21.0~rc1-1+exp1","8.21.0~rc2-1","8.21.0~rc2-1+exp1","8.21.0~rc3-1","8.21.0~rc3-1+exp1","8.22.0-1","8.22.0-1+exp1","8.22.0~rc2-1","8.22.0~rc2-2","8.22.0~rc3-1","8.22.0~rc3-1+exp1","8.23.0-1","8.23.0~rc1-1","8.23.0~rc1-2","8.23.0~rc2-1","8.23.0~rc2-1+exp1","8.23.0~rc3-1","8.23.0~rc3-1+exp1","8.3.0-1","8.3.0-2","8.3.0-2~bpo12+1","8.3.0-2~exp1","8.3.0-3","8.4.0-1","8.4.0-2","8.4.0-2~bpo12+1","8.5.0-1","8.5.0-1+exp1","8.5.0-2","8.5.0-2+exp1","8.5.0-2~bpo12+1","8.6.0-1","8.6.0-1.1","8.6.0-2","8.6.0-3","8.6.0-3.1","8.6.0-3.1~exp1","8.6.0-3.1~exp2","8.6.0-3.2","8.6.0-4","8.7.1-1","8.7.1-1+exp1","8.7.1-2","8.7.1-3","8.7.1-4","8.7.1-5","8.7.1-5+exp1","8.7.1-5~bpo12+1","8.8.0-1","8.8.0-1+exp1","8.8.0-1+exp2","8.8.0-1~bpo12+1","8.8.0-2","8.8.0-3","8.8.0-4","8.9.0-1","8.9.0-2","8.9.0-3","8.9.1-1","8.9.1-2","8.9.1-2~bpo12+1"]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.0+git20250209.89ed161+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.0+git20250209.89ed161+ds-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.13.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.12.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-4.6.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-r00073"},{"fixed":"8.5.0-r00074"},{"fixed":"8.5.0-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-r00073"},{"fixed":"8.5.0-r00074"},{"fixed":"8.5.0-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-r00073"},{"fixed":"8.9.0-r00074"},{"fixed":"8.9.0-r00075"},{"fixed":"8.9.0-r00076"},{"fixed":"8.9.0-r00077"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.17","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-r00073"},{"fixed":"8.9.0-r00074"},{"fixed":"8.9.0-r00075"},{"fixed":"8.9.0-r00076"},{"fixed":"8.9.0-r00077"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10+deb12u14.root.io.11"},{"fixed":"7.88.1-10+deb12u14.root.io.10"},{"fixed":"7.88.1-10+deb12u15.aikido.13"},{"fixed":"7.88.1-10+deb12u15.aikido.14"},{"fixed":"7.88.1-10+deb12u15.aikido.15"},{"fixed":"7.88.1-10+deb12u15.aikido.16"},{"fixed":"7.88.1-10+deb12u15.aikido.17"},{"fixed":"7.88.1-10+deb12u15.aikido.18"},{"fixed":"7.88.1-10+deb12u15.aikido.19"},{"fixed":"7.88.1-10+deb12u15.aikido.20"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10+deb12u14.root.io.11"},{"fixed":"7.88.1-10+deb12u14.root.io.10"},{"fixed":"7.88.1-10+deb12u15.aikido.13"},{"fixed":"7.88.1-10+deb12u15.aikido.14"},{"fixed":"7.88.1-10+deb12u15.aikido.15"},{"fixed":"7.88.1-10+deb12u15.aikido.16"},{"fixed":"7.88.1-10+deb12u15.aikido.17"},{"fixed":"7.88.1-10+deb12u15.aikido.18"},{"fixed":"7.88.1-10+deb12u15.aikido.19"},{"fixed":"7.88.1-10+deb12u15.aikido.20"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.0-150600.4.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.0-150600.4.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Installer Updates 15 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.62.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Installer Updates 15 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.62.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.62.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.62.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.62.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.62.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.62.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.62.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.62.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.62.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.62.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-150400.5.62.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.105.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.105.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.84.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.84.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.84.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.84.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.84.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-150200.4.84.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.0-6.1"}]}],"bundled":2}],"products":[{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"curl"},{"vendor":"haxx","product":"libcurl"},{"vendor":"netapp","product":"hci_baseboard_management_controller"},{"vendor":"netapp","product":"hci_h610c_firmware"},{"vendor":"netapp","product":"hci_h610s_firmware"},{"vendor":"netapp","product":"hci_h615c_firmware"},{"vendor":"netapp","product":"solidfire_\\\u0026_hci_management_node"},{"vendor":"netapp","product":"solidfire_\\\u0026_hci_storage_node"},{"vendor":"siemens","product":"ruggedcom rst2428p"},{"vendor":"siemens","product":"scalance xc-300/xr-300/xc-400/xr-500wg/xr-500 family"},{"vendor":"siemens","product":"scalance xch328"},{"vendor":"siemens","product":"scalance xcm324"},{"vendor":"siemens","product":"scalance xcm328"},{"vendor":"siemens","product":"scalance xcm332"},{"vendor":"siemens","product":"scalance xrh334 (24 v dc, 8xfo, cc)"},{"vendor":"siemens","product":"scalance xrm334 (230 v ac, 12xfo)"},{"vendor":"siemens","product":"scalance xrm334 (230 v ac, 8xfo)"},{"vendor":"siemens","product":"scalance xrm334 (230v ac, 2x10g, 24xsfp, 8xsfp+)"},{"vendor":"siemens","product":"scalance xrm334 (24 v dc, 12xfo)"},{"vendor":"siemens","product":"scalance xrm334 (24 v dc, 8xfo)"},{"vendor":"siemens","product":"scalance xrm334 (24v dc, 2x10g, 24xsfp, 8xsfp+)"},{"vendor":"siemens","product":"scalance xrm334 (2x230 v ac, 12xfo)"},{"vendor":"siemens","product":"scalance xrm334 (2x230 v ac, 8xfo)"},{"vendor":"siemens","product":"scalance xrm334 (2x230v ac, 2x10g, 24xsfp, 8xsfp+)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://curl.se/docs/CVE-2025-0725.json","tags":["Vendor Advisory","web"]},{"url":"https://curl.se/docs/CVE-2025-0725.html","tags":["Vendor Advisory","web"]},{"url":"https://hackerone.com/reports/2956023","tags":["Exploit","Issue Tracking","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/02/05/3","tags":["Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/02/06/2","tags":["Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/02/06/4","tags":["Mailing List","web"]},{"url":"https://security.netapp.com/advisory/ntap-20250306-0009/","tags":["Third Party Advisory","advisory","web"]},{"url":"https://github.com/curl/curl/commit/76f83f0db23846e254d940ec7","tags":["Patch","fix","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-089022.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0725","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20250306-0009","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vvqh-cqpj-5537","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-0725","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-0725","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0725.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-0725","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0123.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33992","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33893","tags":["report"]},{"url":"https://curl.se/docs/CVE-2025-0167.html","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGAA-2025-0004.html","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250369-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236588","tags":["report"]},{"url":"https://bugzilla.suse.com/1236590","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0725","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250370-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250371-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250372-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520144-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1235151","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-0725","title":"gzip integer overflow","description":"When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow.","status":"published","published":"2025-02-05T09:18:20.468Z","modified":"2026-10-15T01:01:56.278Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:32:53.475217Z"}],"euvd":[{"id":"EUVD-2025-1837","description":"When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow.","status":"published","published":"2025-02-05T09:18:20Z","modified":"2026-10-15T01:01:56Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T17:27:08.661475Z"}],"ghsa":[{"id":"GHSA-vvqh-cqpj-5537","title":"When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses...","description":"When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow.","status":"published","published":"2025-02-05T12:33:07Z","modified":"2026-10-15T03:35:33Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T15:13:32.679528Z"}],"nvd":[{"id":"CVE-2025-0725","description":"When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow.","status":"published","published":"2025-02-05T10:15:22.98Z","modified":"2026-10-15T02:17:22.237Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:10:50.916773Z"}],"osv":[{"id":"ALPINE-CVE-2025-0725","description":"When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow.","status":"published","published":"2025-02-05T10:15:22.98Z","modified":"2026-08-27T22:18:02.754168045Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2025-0725","title":"CVE-2025-0725 does not affect BellSoft software","status":"withdrawn","published":"2025-02-09T05:56:56.775823Z","modified":"2026-01-26T09:48:14.659476Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"CVE-2025-0725","title":"gzip integer overflow","description":"When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow.","status":"published","published":"2025-02-05T09:18:20.468Z","modified":"2026-10-28T02:30:29.929181018Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:44:45.712478Z"},{"id":"DEBIAN-CVE-2025-0725","description":"When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.","status":"published","published":"2025-02-05T10:15:22.98Z","modified":"2026-10-15T10:02:03.515066899Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"JLSEC-2026-422","title":"When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with...","description":"When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow.","status":"published","published":"2026-05-04T13:12:06.605Z","modified":"2026-07-25T18:24:24.620383597Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"ROOT-OS-ALPINE-315-CVE-2025-0725","title":"CVE-2025-0725 in curl - Patched by Root","description":"Root has patched CVE-2025-0725 in the curl package for Root:Alpine:3.15. Multiple fixed versions available.","status":"published","published":"2026-11-04T10:54:49Z","modified":"2026-11-04T11:15:05.242338371Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-04T11:38:21.953745Z"},{"id":"ROOT-OS-ALPINE-317-CVE-2025-0725","title":"CVE-2025-0725 in curl - Patched by Root","description":"Root has patched CVE-2025-0725 in the curl package for Root:Alpine:3.17. Multiple fixed versions available.","status":"published","published":"2026-11-04T16:15:55Z","modified":"2026-11-04T17:16:12.086816292Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2025-0725","title":"CVE-2025-0725 in curl - Patched by Root","description":"Root has patched CVE-2025-0725 in the curl package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-11-04T06:00:50Z","modified":"2026-11-04T07:15:09.189692707Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-04T07:32:10.855619Z"},{"id":"AZL-56471","title":"CVE-2025-0725 affecting package mysql for versions less than 8.0.40-4","description":"When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow.","status":"published","published":"2025-02-05T10:15:22Z","modified":"2026-04-21T04:36:08.798944Z","updated_at":"2026-11-02T15:28:07.209678Z"},{"id":"AZL-56498","title":"CVE-2025-0725 affecting package mysql for versions less than 8.0.42-1","description":"When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow.","status":"published","published":"2025-02-05T10:15:22Z","modified":"2026-04-21T04:51:00.660382Z","updated_at":"2026-11-02T15:28:07.209678Z"},{"id":"AZL-56504","title":"CVE-2025-0725 affecting package curl for versions less than 8.11.1-3","description":"When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow.","status":"published","published":"2025-02-05T10:15:22Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.162429Z"},{"id":"CURL-CVE-2025-0725","title":"gzip integer overflow","description":"When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow.","status":"published","published":"2025-02-05T08:00:00Z","modified":"2026-10-25T01:04:40.519169935Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"MGASA-2025-0123","title":"Updated curl packages fix security vulnerabilities","description":"When asked to use a .netrc file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances. The fix was included\npreviously as part of MGAA-2025-0004.\n","status":"published","published":"2025-04-03T01:36:32Z","modified":"2026-04-16T04:44:31.498401235Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"SUSE-SU-2025:0369-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2025-0725: Fixed gzip integer overflow (bsc#1236590)\n- CVE-2025-0167: Fixed netrc and default credential leak (bsc#1236588)\n","status":"published","published":"2025-02-05T15:32:37Z","modified":"2026-02-04T02:46:19.170255Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:0370-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2025-0725: Fixed gzip integer overflow (bsc#1236590)\n- CVE-2025-0167: Fixed netrc and default credential leak (bsc#1236588)\n","status":"published","published":"2025-02-05T15:34:43Z","modified":"2026-02-04T04:28:54.942725Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:0371-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2025-0725: Fixed gzip integer overflow (bsc#1236590)\n- CVE-2025-0167: Fixed netrc and default credential leak (bsc#1236588)\n","status":"published","published":"2025-02-05T15:34:55Z","modified":"2026-02-04T04:37:59.370759Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:0372-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2025-0725: Fixed gzip integer overflow (bsc#1236590)\n- CVE-2025-0167: Fixed netrc and default credential leak (bsc#1236588)\n","status":"published","published":"2025-02-05T15:36:16Z","modified":"2026-02-04T03:34:56.653475Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:20144-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2025-0725: Fixed gzip integer overflow (bsc#1236590)\n- CVE-2025-0167: Fixed netrc and default credential leak (bsc#1236588)\n\nOther issues fixed:\n\n- Make sure the TLS handshake after a successful STARTTLS command\n  is fully done before further sending/receiving on the connection.  (bsc#1235151)\n","status":"published","published":"2025-03-12T10:47:54Z","modified":"2026-03-23T04:50:42.316476Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}