---
id: CVE-2025-0665
title: |-
  libcurl would wrongly close the same eventfd file descriptor twice when taking
  down a connection channel after having completed a threaded name resolve.
summary: |-
  libcurl would wrongly close the same eventfd file descriptor twice when taking
  down a connection channel after having completed a threaded name resolve.
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H'
vendor: haxx
product: curl
affected:
  - curl = 8.11.1
  - bootstrap_os
  - h300s_firmware
  - h410c_firmware
  - h410s_firmware
  - h500s_firmware
  - h700s_firmware
published: '2025-02-05'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:17:22.017'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-0665'
references:
  - url: 'https://curl.se/docs/CVE-2025-0665.html'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://curl.se/docs/CVE-2025-0665.json'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://hackerone.com/reports/2954286'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'http://www.openwall.com/lists/oss-security/2025/02/05/2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/02/05/5'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20250306-0007/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-089022.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.01331
epssPercentile: 0.70645
ingestedAt: '2026-10-15T03:30:12.782Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-03-17T17:42:03.317434Z'
cwe:
  - CWE-1341
---

## Overview

libcurl would wrongly close the same eventfd file descriptor twice when taking
down a connection channel after having completed a threaded name resolve.

## Affected

- `curl = 8.11.1`
- `bootstrap_os`
- `h300s_firmware`
- `h410c_firmware`
- `h410s_firmware`
- `h500s_firmware`
- `h700s_firmware`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.