CVE-2025-10966
ADVISORY - debianSummary
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.
- curl 8.17.0~rc2-1 (unimportant) https://curl.se/docs/CVE-2025-10966.html Introduced with: https://github.com/curl/curl/commit/6773c7ca65cf2183295e56603f9b86a5ce816a06 (curl-7_69_0) Fixed by: https://github.com/curl/curl/commit/b011e3fcfb06d6c0278595ee2ee297036fbe9793 (rc-8_17_0-1) wolfSSH backend not used in Debian
EPSS Score: 0.00399 (0.335)
Common Weakness Enumeration (CWE)
ADVISORY - nist
Key Exchange without Entity Authentication
ADVISORY - redhat
Key Exchange without Entity Authentication
Debian
CREATED
UPDATED
ADVISORY IDCVE-2025-10966
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/Alow| Package | Type | OS Name | OS Version | Affected Ranges | Fix Versions |
|---|---|---|---|---|---|
| debian/curl | deb | debian | 12 | >0 | Not yet available |
| debian/curl | deb | debian | 14 | <8.17.0~rc2-1 | 8.17.0~rc2-1 |
| debian/curl | deb | debian | unstable | <8.17.0~rc2-1 | 8.17.0~rc2-1 |
| debian/curl | deb | debian | 13 | >0 | Not yet available |
Severity and metrics
No CVSS data available from this advisory.
NIST
CREATED
UPDATED
ADVISORY IDCVE-2025-10966
EXPLOITABILITY SCORE
2.8
EXPLOITS FOUND
COMMON WEAKNESS ENUMERATION (CWE)
CVSS SCORE
4.3mediumAlpine
CREATED
UPDATED
ADVISORY IDCVE-2025-10966
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Ubuntu
CREATED
UPDATED
ADVISORY IDCVE-2025-10966
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AlowAmazon
CREATED
UPDATED
ADVISORY IDALAS2-2026-3173
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AmediumAmazon
CREATED
UPDATED
ADVISORY IDALAS2023-2025-1351
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AmediumRed Hat
CREATED
UPDATED
ADVISORY IDCVE-2025-10966
EXPLOITABILITY SCORE
2.2
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
CVSS SCORE
5.9mediumPhoton
CREATED
UPDATED
ADVISORY ID
CVE-2025-10966
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
4.3mediumminimos
CREATED
UPDATED
ADVISORY ID
MINI-wjwx-mxp5-69f6
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-