CVE-2025-49015

State: Published
Severity: 4.9 Medium
Published: Jun 18, 2025
Updated: Jun 18, 2025
Reserved: May 30, 2025

Description

The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.

Scores

CVSS	Score	Vector	Source
3.1	4.9 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	CISA-ADP

Weaknesses

CWE-297 Improper Validation of Certificate with Host Mismatch

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://forums.couchbase.com/tags/security
https://docs.couchbase.com/server/current/release-notes/relnotes.html
https://www.couchbase.com/alerts/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.