Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
CVE-2025-0725 Details
Description
When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 5, 2025Exploitation: PocAutomatable: YesTechnical Impact: Partial
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://curl.se/docs/CVE-2025-0725.html | curl | Vendor Advisory |
| https://curl.se/docs/CVE-2025-0725.json | curl | Vendor Advisory |
| https://hackerone.com/reports/2956023 | curl | ExploitIssue Tracking |
| https://github.com/curl/curl/commit/76f83f0db23846e254d940ec7 | CVE | Patch |
| https://security.netapp.com/advisory/ntap-20250306-0009/ | CVE | Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2025/02/05/3 | CVE | Mailing List |
| http://www.openwall.com/lists/oss-security/2025/02/06/2 | CVE | Mailing List |
| http://www.openwall.com/lists/oss-security/2025/02/06/4 | CVE | Mailing List |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| netapp hci baseboard management controller | All versions |
CPE
Remediation
| |
| netapp hci h610s firmware | All versions |
CPE
Remediation
| |
| netapp hci h610s | All versions |
CPE
Remediation
| |
| netapp hci h610c firmware | All versions |
CPE
Remediation
| |
| netapp hci h610c | All versions |
CPE
Remediation
| |
| netapp hci h615c firmware | All versions |
CPE
Remediation
| |
| netapp hci h615c | All versions |
CPE
Remediation
| |
| netapp solidfire & hci management node | All versions |
CPE
Remediation
| |
| netapp solidfire & hci storage node | All versions |
CPE
Remediation
| |
| haxx curl | >= 7.10.5, < 8.12.0 |
CPE
Remediation
| |
| haxx libcurl | >= 7.10.5, < 8.12.0 |
CPE
Remediation
| |
| zlib zlib | <= 1.2.0.3 |
CPE
Remediation
| |
Change History
11 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | curl |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 27, 2025 | Modified Analysis | [email protected] |
| Jun 12, 2025 | CVE Modified | CVE |
| May 13, 2025 | Initial Analysis | [email protected] |
| Mar 7, 2025 | CVE Modified | CVE |
| Feb 6, 2025 | CVE Modified | CVE |
| Feb 6, 2025 | CVE Modified | CVE |
| Feb 5, 2025 | CVE Modified | CISA-ADP |
| Feb 5, 2025 | CVE Modified | CVE |
| Feb 5, 2025 | New CVE Received | curl |