Logo
›
›vulnerability›CVE-2025-0725
Name
CVE-2025-0725
Source
NVD ( link)Debian ( link)
Description
When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.
CWEs
CWE-120
Published Date
Updated Date
Workaround
-
Advisories
https://curl.se/docs/CVE-2025-0725.htmlVendor Advisory
https://curl.se/docs/CVE-2025-0725.jsonVendor Advisory
https://hackerone.com/reports/2956023Exploit
http://www.openwall.com/lists/oss-security/2025/02/05/3Mailing List
http://www.openwall.com/lists/oss-security/2025/02/06/2Mailing List
http://www.openwall.com/lists/oss-security/2025/02/06/4Mailing List
https://github.com/curl/curl/commit/76f83f0db23846e254d940ec7Patch
https://security.netapp.com/advisory/ntap-20250306-0009/Third Party Advisory

Analysis#

Affected Component
Analysis
curl
False Positive

Vulnerability Ratings#

7.3
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
libcurl
buildroot
2025.02.x
8.20.0
Not Affected
libcurl
buildroot
master
8.21.0
Not Affected
curl
openwrt
master
8.19.0-r2
Not Affected
libcurl-gnutls
openwrt
master
8.20.0-r1
Not Affected
curl
openwrt
openwrt-25.12
8.19.0-r2
Not Affected
libcurl-gnutls
openwrt
openwrt-25.12
8.14.1-r1
Not Affected
curl
yocto
kirkstone
7.82.0
Not Affected
curl
yocto
master
8.20.0
Not Affected