Cyber Resilience

CVE-2025-14017

Haxx Curl 7.17.0 – 8.18.0

Published
08 January 2026
Modified
27 January 2026
Patch / advisory
View advisory
CVSS Score v3.1 6.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS Score 0.0011 1th percentile
Risk Priority 40 floored blend · peak EPSS

Summary

CVE-2025-14017 is a medium-severity an unspecified weakness vulnerability in Haxx Curl. Its CVSS base score is 6.3 (Medium).

Operationally, ranked at the 1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-39 (Process Isolation) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable…

more

the feature for other threads as well.

CWE(s)
NVD-CWE-Other

Related Threats

CVEs Like This One

CVE-2026-8932Same product: Haxx Curl
CVE-2025-5399Same product: Haxx Curl
CVE-2026-6429Same product: Haxx Curl
CVE-2025-10966Same product: Haxx Curl
CVE-2026-7009Same product: Haxx Curl
CVE-2025-13034Same product: Haxx Curl
CVE-2024-9681Same product: Haxx Curl
CVE-2026-5545Same product: Haxx Curl
CVE-2026-8924Same product: Haxx Curl
CVE-2026-8286Same product: Haxx Curl

Affected Assets

haxx
curl
7.17.0 — 8.18.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SC-39 Process Isolation
  • SC-8 Transmission Confidentiality and Integrity
  • SC-3 Security Function Isolation
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SC-39 Process Isolation good match
prevent

Enforces process/thread isolation so that TLS configuration state for one LDAPS transfer cannot inadvertently mutate settings used by concurrent transfers.

SC-8 Transmission Confidentiality and Integrity good match
prevent

Requires cryptographic protection and integrity of remote sessions, directly countering the risk that certificate verification is globally disabled for LDAPS.

SC-3 Security Function Isolation partial match
prevent

Isolates security functions (TLS handling) from other processing, reducing the chance that per-transfer options become shared global state.

References