Home > Vulnerability Database > CVE-2025-10966

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2025-10966

Good to know:

Date: November 7, 2025

Missing SFTP host verification with wolfSSH in curl 7.69.0 to and including 8.16.0. Fixed in 8.17.0

Severity Score

7.5

Related Resources (6)

Url: https://curl.se/docs/CVE-2025-10966.json

Url: http://www.openwall.com/lists/oss-security/2025/11/05/2

Url: https://curl.se/docs/CVE-2025-10966.html

Url: https://hackerone.com/reports/3355218

Url: https://nvd.nist.gov/vuln/detail/CVE-2025-10966

Url: https://www.mend.io/vulnerability-database/CVE-2025-10966

Severity Score

7.5

Weakness Type (CWE)

Key Exchange without Entity Authentication

CWE-322

Top Fix

Upgrade Version

Upgrade to version https://github.com/curl/curl.git - curl-8_17_0

CVSS v3.1

Base Score:	7.5
Attack Vector (AV):	LOCAL
Attack Complexity (AC):	HIGH
Privileges Required (PR):	LOW
User Interaction (UI):	REQUIRED
Scope (S):	CHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Do you need more information?

Contact Us