Medium severity · published Nov 7, 2025
CVE-2025-10966
missing SFTP host verification with wolfSSH
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
curl's code for managing SSH connections when SFTP was done using the wolfSSH
powered backend was flawed and missed host verification mechanisms.
This prevents curl from detecting MITM attackers and more.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
curl · curl
7.69.0 before 8.14.2; 8.15.0 before 8.16.1; 6773c7ca65cf2183295e56603f9b86a5ce816a06 before b011e3fcfb06d6c0278595ee2ee297036fbe9793; 8.16.0; 8.15.0; 8.14.1; +34 more · source: vendor, NVD
RR
RUGGEDCOM RST2428P · Siemens
before V4.0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-10966
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-10966
Patch
https://curl.se/docs/CVE-2025-10966.html
Vendor Advisory
https://curl.se/docs/CVE-2025-10966.json
Exploit
https://hackerone.com/reports/3355218
Mailing List
http://www.openwall.com/lists/oss-security/2025/11/05/2
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-253495.html
More from curl
9.8
CVE-2026-19931
Negotiate ambient user conn reuse
9.8
CVE-2026-9079
stale proxy password leak
9.8
CVE-2026-8925
SASL double-free
9.8
CVE-2026-11856
cross-origin Digest auth state leak
9.8
CVE-2026-10536
HTTP/2 stream-dependency tree UAF