CVE-2025-10966

missing SFTP host verification with wolfSSH

CVSS 4.3 MEDIUMEPSS 0.4%

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

curl · curl

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://cert-portal.siemens.com/productcert/html/ssa-253495.html https://curl.se/docs/CVE-2025-10966.html https://curl.se/docs/CVE-2025-10966.json https://hackerone.com/reports/3355218 http://www.openwall.com/lists/oss-security/2025/11/05/2