CVE-2025-14819

When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://curl.se/docs/CVE-2025-14819.html	Mitigation Patch Vendor Advisory
https://curl.se/docs/CVE-2025-14819.json	Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/01/07/5	Mailing List Mitigation Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

History

14 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Al realizar transferencias relacionadas con TLS con manejadores easy o multi reutilizados y al alterar la opción 'CURLSSLOPT_NO_PARTIALCHAIN', libcurl podría reutilizar accidentalmente un almacén de CA almacenado en caché en memoria para el cual la opción de cadena parcial se había invertido. Contrario a los deseos y expectativas del usuario. Esto podría hacer que libcurl encontrara y aceptara una cadena de confianza que de otro modo no lo haría.

Information

Published : 2026-01-08 10:15

Updated : 2026-10-14 19:10

NVD link : CVE-2025-14819

Mitre link : CVE-2025-14819

CVE.ORG link : CVE-2025-14819

JSON object : View

Products Affected

haxx

curl

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2025-14819", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14819", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T15:00:02.949618Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "affected": [{"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "affectedData": [{"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "7.87.0", "lessThan": "8.14.2", "versionType": "semver"}, {"status": "affected", "version": "8.15.0", "lessThan": "8.16.1", "versionType": "semver"}, {"status": "affected", "version": "8.17.0", "lessThan": "8.18.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"repo": "https://github.com/curl/curl.git", "vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "3c16697ebd796f799227be293e8689aec5f8190d", "lessThan": "cd046f6c93b39d673a58c18648d8906e954c4f5d", "versionType": "git"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.17.0"}, {"status": "affected", "version": "8.16.0"}, {"status": "affected", "version": "8.15.0"}, {"status": "affected", "version": "8.14.1"}, {"status": "affected", "version": "8.14.0"}, {"status": "affected", "version": "8.13.0"}, {"status": "affected", "version": "8.12.1"}, {"status": "affected", "version": "8.12.0"}, {"status": "affected", "version": "8.11.1"}, {"status": "affected", "version": "8.11.0"}, {"status": "affected", "version": "8.10.1"}, {"status": "affected", "version": "8.10.0"}, {"status": "affected", "version": "8.9.1"}, {"status": "affected", "version": "8.9.0"}, {"status": "affected", "version": "8.8.0"}, {"status": "affected", "version": "8.7.1"}, {"status": "affected", "version": "8.7.0"}, {"status": "affected", "version": "8.6.0"}, {"status": "affected", "version": "8.5.0"}, {"status": "affected", "version": "8.4.0"}, {"status": "affected", "version": "8.3.0"}, {"status": "affected", "version": "8.2.1"}, {"status": "affected", "version": "8.2.0"}, {"status": "affected", "version": "8.1.2"}, {"status": "affected", "version": "8.1.1"}, {"status": "affected", "version": "8.1.0"}, {"status": "affected", "version": "8.0.1"}, {"status": "affected", "version": "8.0.0"}, {"status": "affected", "version": "7.88.1"}, {"status": "affected", "version": "7.88.0"}, {"status": "affected", "version": "7.87.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-08T10:15:46.730", "references": [{"url": "https://curl.se/docs/CVE-2025-14819.html", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}, {"url": "https://curl.se/docs/CVE-2025-14819.json", "tags": ["Vendor Advisory"], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}, {"url": "http://www.openwall.com/lists/oss-security/2026/01/07/5", "tags": ["Mailing List", "Mitigation", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "2499f714-1537-4658-8207-48ae4bb9eae9", "description": [{"lang": "en", "value": "CWE-295"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "When doing TLS related transfers with reused easy or multi handles and\naltering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user's wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not."}, {"lang": "es", "value": "Al realizar transferencias relacionadas con TLS con manejadores easy o multi reutilizados y al alterar la opci\u00f3n 'CURLSSLOPT_NO_PARTIALCHAIN', libcurl podr\u00eda reutilizar accidentalmente un almac\u00e9n de CA almacenado en cach\u00e9 en memoria para el cual la opci\u00f3n de cadena parcial se hab\u00eda invertido. Contrario a los deseos y expectativas del usuario. Esto podr\u00eda hacer que libcurl encontrara y aceptara una cadena de confianza que de otro modo no lo har\u00eda."}], "lastModified": "2026-10-14T19:10:00.297", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83978599-3111-4F13-BFAE-1B0423D8A75F", "versionEndExcluding": "8.18.0", "versionStartIncluding": "7.87.0"}], "operator": "OR"}]}], "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9"}