curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://curl.se/docs/CVE-2025-10966.html Patch, Vendor Advisory
- https://curl.se/docs/CVE-2025-10966.json Vendor Advisory
- http://www.openwall.com/lists/oss-security/2025/11/05/2 Mailing List, Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 4.3 · haxxNVD modified 2026-10-19 13:10
Affected (CPE criteria) 1
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
References 5
- https://curl.se/docs/CVE-2025-10966.html Patch, Vendor Advisory
- https://curl.se/docs/CVE-2025-10966.json Vendor Advisory
- https://hackerone.com/reports/3355218 Exploit, Issue Tracking, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2025/11/05/2 Mailing List, Patch, Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html