CVE-2025-10966

missing SFTP host verification with wolfSSH

CVSS 4.3 MEDIUMEPSS 0.4%

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Productos afectados

curl · curl

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://cert-portal.siemens.com/productcert/html/ssa-253495.html https://curl.se/docs/CVE-2025-10966.html https://curl.se/docs/CVE-2025-10966.json https://hackerone.com/reports/3355218 http://www.openwall.com/lists/oss-security/2025/11/05/2