CVE-2025-14819

When doing TLS related transfers with reused easy or multi handles and altering the CURLSSLOPT_NO_PARTIALCHAIN option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.

• curl 8.18.0~rc3-1 [trixie] - curl 8.14.1-2+deb13u4 [bookworm] - curl 7.88.1-10+deb12u15 [bullseye] - curl (Vulnerable code introduced later) https://curl.se/docs/CVE-2025-14819.html Introduced with: https://github.com/curl/curl/commit/3c16697ebd796f799227be293e8689aec5f8190d (curl-7_87_0) Fixed by: https://github.com/curl/curl/commit/cd046f6c93b39d673a58c18648d8906e954c4f5d (rc-8_18_0-3, curl-8_18_0)