Riskcovery

CVE-2025-10966

missing SFTP host verification with wolfSSH

State
Published
Severity
4.3 Medium
Published
Nov 7, 2025
Updated
Sep 15, 2026
Reserved
Sep 25, 2025

Read the record on cve.org

Description

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.

This prevents curl from detecting MITM attackers and more.

Scores

CVSSScoreVectorSource
3.14.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCISA-ADP

Weaknesses

  • CWE-322 Key Exchange without Entity Authentication

Affected Products

ProductVersions
curlcurl
  • 7.69.0 to before 8.14.2Affected
  • 8.15.0 to before 8.16.1Affected
curlcurl
  • 6773c7ca65cf2183295e56603f9b86a5ce816a06 to before b011e3fcfb06d6c0278595ee2ee297036fbe9793Affected
curlcurl
  • 8.16.0Affected
  • 8.15.0Affected
  • 8.14.1Affected
  • 8.14.0Affected
  • 8.13.0Affected
  • 8.12.1Affected
  • 8.12.0Affected
  • 8.11.1Affected
  • 8.11.0Affected
  • 8.10.1Affected
  • 8.10.0Affected
  • 8.9.1Affected
  • 8.9.0Affected
  • 8.8.0Affected
  • 8.7.1Affected
  • 8.7.0Affected
  • 8.6.0Affected
  • 8.5.0Affected
  • 8.4.0Affected
  • 8.3.0Affected
  • 8.2.1Affected
  • 8.2.0Affected
  • 8.1.2Affected
  • 8.1.1Affected
  • 8.1.0Affected
  • and 28 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.