DEBIAN-CVE-2025-10966

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2025-10966
Published: 07 Nov 2025, 08:15
Last modified:15 Jun 2026, 19:05

Vulnerability Summary

Overall Risk (default)
low
17/100
CVSS Score
4.3 MEDIUM
3.1 (osv_debian)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

07 Nov 2025, 08:15
Published
Vulnerability first disclosed
15 Jun 2026, 19:05
Last Modified
Vulnerability information updated

Description

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

CVSS Metrics

  • v3.1•MEDIUM•Score: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected Systems

  • debian•curl

    all | all | all | < 8.17.0~rc2-1

References (1)