CVE-2025-0725

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-0725

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

W

hen libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.

References
Link Resource
https://curl.se/docs/CVE-2025-0725.html Vendor Advisory
https://curl.se/docs/CVE-2025-0725.json Vendor Advisory
https://hackerone.com/reports/2956023 Exploit Issue Tracking
http://www.openwall.com/lists/oss-security/2025/02/05/3 Mailing List
http://www.openwall.com/lists/oss-security/2025/02/06/2 Mailing List
http://www.openwall.com/lists/oss-security/2025/02/06/4 Mailing List
https://github.com/curl/curl/commit/76f83f0db23846e254d940ec7 Patch
https://security.netapp.com/advisory/ntap-20250306-0009/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:netapp:hci_baseboard_management_controller:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:netapp:hci_h610s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h610s:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:netapp:hci_h610c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h610c:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:netapp:hci_h615c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h615c:-:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire_\&_hci_storage_node:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
OR cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:*
cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:*
History

27 Jun 2025, 19:24

Type Values Removed Values Added
CPE cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:*
References () https://github.com/curl/curl/commit/76f83f0db23846e254d940ec7 - () https://github.com/curl/curl/commit/76f83f0db23846e254d940ec7 - Patch
First Time Zlib zlib
Zlib

12 Jun 2025, 16:15

Type Values Removed Values Added
References
  • () https://github.com/curl/curl/commit/76f83f0db23846e254d940ec7 -

13 May 2025, 18:35

Type Values Removed Values Added
First Time Haxx
Netapp hci H610s Firmware
Netapp solidfire \& Hci Storage Node
Netapp hci H610c Firmware
Netapp hci Baseboard Management Controller
Netapp hci H610s
Netapp solidfire \& Hci Management Node
Haxx curl
Netapp hci H615c
Haxx libcurl
Netapp hci H615c Firmware
Netapp
Netapp hci H610c
CWE CWE-120
CPE cpe:2.3:a:netapp:hci_baseboard_management_controller:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h610s:-:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_h615c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_h610s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_h610c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h610c:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h615c:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire_\&_hci_storage_node:-:*:*:*:*:*:*:*
References () https://curl.se/docs/CVE-2025-0725.html - () https://curl.se/docs/CVE-2025-0725.html - Vendor Advisory
References () https://curl.se/docs/CVE-2025-0725.json - () https://curl.se/docs/CVE-2025-0725.json - Vendor Advisory
References () https://hackerone.com/reports/2956023 - () https://hackerone.com/reports/2956023 - Exploit, Issue Tracking
References () http://www.openwall.com/lists/oss-security/2025/02/05/3 - () http://www.openwall.com/lists/oss-security/2025/02/05/3 - Mailing List
References () http://www.openwall.com/lists/oss-security/2025/02/06/2 - () http://www.openwall.com/lists/oss-security/2025/02/06/2 - Mailing List
References () http://www.openwall.com/lists/oss-security/2025/02/06/4 - () http://www.openwall.com/lists/oss-security/2025/02/06/4 - Mailing List
References () https://security.netapp.com/advisory/ntap-20250306-0009/ - () https://security.netapp.com/advisory/ntap-20250306-0009/ - Third Party Advisory

07 Mar 2025, 01:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20250306-0009/ -

06 Feb 2025, 19:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2025/02/06/4 -

06 Feb 2025, 11:15

Type Values Removed Values Added
Summary
  • (es) Cuando se le solicita a libcurl que realice una descompresión gzip automática de respuestas HTTP codificadas con contenido con la opción `CURLOPT_ACCEPT_ENCODING`, **usando zlib 1.2.0.3 o anterior**, un desbordamiento de entero controlado por un atacante haría que libcurl realice un desbordamiento de búfer.
References
  • () http://www.openwall.com/lists/oss-security/2025/02/06/2 -

05 Feb 2025, 15:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.3

05 Feb 2025, 11:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2025/02/05/3 -

05 Feb 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-05 10:15

Updated : 2025-06-27 19:24

NVD link : CVE-2025-0725

Mitre link : CVE-2025-0725

CVE.ORG link : CVE-2025-0725

JSON object : View

Products Affected

haxx

netapp

zlib

CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')