gzip integer overflow
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.3epss 1.3%
probabilidad de explotación
1.3%top 32% de las CVE
explotación observada
noninguna fuente lo reporta
When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,
**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would
make libcurl perform a buffer overflow.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Productos afectados
curl · curlReferencias
https://curl.se/docs/CVE-2025-0725.htmlhttps://curl.se/docs/CVE-2025-0725.jsonhttps://github.com/curl/curl/commit/76f83f0db23846e254d940ec7https://hackerone.com/reports/2956023https://security.netapp.com/advisory/ntap-20250306-0009/http://www.openwall.com/lists/oss-security/2025/02/05/3http://www.openwall.com/lists/oss-security/2025/02/06/2http://www.openwall.com/lists/oss-security/2025/02/06/4