| Name | CVE-2025-14017 |
| Description | When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| curl (PTS) | bullseye | 7.74.0-1.3+deb11u13 | vulnerable |
| bullseye (security) | 7.74.0-1.3+deb11u16 | vulnerable |
| bookworm | 7.88.1-10+deb12u14 | vulnerable |
| bookworm (security) | 7.88.1-10+deb12u5 | vulnerable |
| trixie | 8.14.1-2+deb13u2 | vulnerable |
| forky, sid | 8.18.0-2 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| curl | source | (unstable) | 8.18.0~rc2-1 | unimportant | | |
Notes
https://curl.se/docs/CVE-2025-14017.html
Introduced with: https://github.com/curl/curl/commit/ccba0d10b6baf5c73cae8cf4fb3f29f0f55c5a34 (curl-7_17_0)
Fixed by: https://github.com/curl/curl/commit/39d1976b7f709a516e3243338ebc0443bdd8d56d (rc-8_18_0-1, curl-8_18_0)
Built with OpenLDAP (only affects the legacy LDAP support)