CVE-2025-14017
Medium · 6.3CVSS
6.3
EPSS
0.1%
Published
Jan 8, 2026
CISA due date
—
The record
When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:9 | curl | 0 | 7.88.1-4.9.mga9 |
| openSUSE:Leap 15.6 | curl | 0 | 8.14.1-150600.4.37.1 |
| openSUSE:Leap 16.0 | curl | 0 | 8.14.1-160000.4.1 |
| openSUSE:Tumbleweed | curl | 0 | 8.18.0-1.1 |
Related vulnerabilities
- CVE-2025-15224 When doing SSH-based transfers using either SCP or SFTP, and asked to do public key… Also affects curl
- CVE-2025-15079 When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts… Also affects curl
- CVE-2025-14819 When doing TLS related transfers with reused easy or multi handles and altering the… Also affects curl
- CVE-2025-14524 When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a… Also affects curl
- CVE-2024-11053 When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl… Also affects curl
- CVE-2024-9681 When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent… Also affects curl
- CVE-2023-46219 When saving HSTS data to an excessively long file name, curl could end up removing all… Also affects curl
- CVE-2023-46218 This flaw allows a malicious HTTP server to set "super cookies" in curl that are then… Also affects curl