Cyber Resilience

CVE-2025-10966

Haxx Curl 7.69.0 – 8.17.0

Public PoC
Published
07 November 2025
Modified
02 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 4.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0039 32th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-10966 is a medium-severity an unspecified weakness vulnerability in Haxx Curl. Its CVSS base score is 4.3 (Medium).

Operationally, ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to IA-3 (Device Identification and Authentication) and SC-23 (Session Authenticity) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

CWE(s)
NVD-CWE-noinfo

Related Threats

CVEs Like This One

CVE-2026-8932Same product: Haxx Curl
CVE-2025-5399Same product: Haxx Curl
CVE-2026-6429Same product: Haxx Curl
CVE-2026-7009Same product: Haxx Curl
CVE-2025-14017Same product: Haxx Curl
CVE-2025-13034Same product: Haxx Curl
CVE-2024-9681Same product: Haxx Curl
CVE-2026-5545Same product: Haxx Curl
CVE-2026-8924Same product: Haxx Curl
CVE-2026-8286Same product: Haxx Curl

Affected Assets

haxx
curl
7.69.0 — 8.17.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SC-23 Session Authenticity
  • IA-3 Device Identification and Authentication
  • SC-8 Transmission Confidentiality and Integrity
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SC-23 Session Authenticity good match
prevent

Directly requires cryptographic mechanisms to provide session authenticity, which would have enforced the missing SSH host verification and blocked MITM on wolfSSH-backed SFTP connections.

IA-3 Device Identification and Authentication good match
prevent

Mandates device identification and authentication before establishing remote connections, directly addressing the absent host-key verification in curl's SSH backend.

SC-8 Transmission Confidentiality and Integrity partial match
prevent

Requires cryptographic integrity protection for transmitted data, mitigating the MITM risk that the flawed wolfSSH host verification failed to prevent.

References