CVE-2025-10966

missing SFTP host verification with wolfSSH

CVSS 4.3 MEDIUMEPSS 0.4%

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Produtos afetados

curl · curl

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://cert-portal.siemens.com/productcert/html/ssa-253495.html https://curl.se/docs/CVE-2025-10966.html https://curl.se/docs/CVE-2025-10966.json https://hackerone.com/reports/3355218 http://www.openwall.com/lists/oss-security/2025/11/05/2