CVE search · CVE-2025-0725
CVE-2025-0725
high 7.3
When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.
Details
- Status
- Modified
- Published
- Last changed
- Source
- 2499f714-1537-4658-8207-48ae4bb9eae9
- Weakness
- CWE-120
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | high 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- netapp · hci_baseboard_management_controller
- netapp · hci_h610s_firmware
- netapp · hci_h610c_firmware
- netapp · hci_h615c_firmware
- netapp · solidfire_&_hci_management_node
- netapp · solidfire_&_hci_storage_node
- haxx · curl
- haxx · libcurl
References
- https://curl.se/docs/CVE-2025-0725.htmlVendor Advisory
- https://curl.se/docs/CVE-2025-0725.jsonVendor Advisory
- https://hackerone.com/reports/2956023ExploitIssue Tracking
- http://www.openwall.com/lists/oss-security/2025/02/05/3Mailing List
- http://www.openwall.com/lists/oss-security/2025/02/06/2Mailing List
- http://www.openwall.com/lists/oss-security/2025/02/06/4Mailing List
- https://github.com/curl/curl/commit/76f83f0db23846e254d940ec7Patch
- https://security.netapp.com/advisory/ntap-20250306-0009/Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-089022.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html