ALPINE-CVE-2025-10966

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2025-10966
Published: 07 Nov 2025, 08:15
Last modified:08 Jul 2026, 04:32

Vulnerability Summary

Overall Risk (default)
low
17/100
CVSS Score
4.3 MEDIUM
3.1 (osv_alpine)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

07 Nov 2025, 08:15
Published
Vulnerability first disclosed
08 Jul 2026, 04:32
Last Modified
Vulnerability information updated

Description

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

CVSS Metrics

  • v3.1•MEDIUM•Score: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected Systems

  • alpine•curl

    < 8.17.0-r0 | < 8.17.0-r0 | ≥ 7.69.0, < 8.17.0-r0 | ≥ 7.69.0, < 8.17.0-r0

References (1)