---
id: CVE-2025-0725
title: |-
  When libcurl is asked to perform automatic gzip decompression of
  content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,
  **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would
  make libcurl perfor…
summary: |-
  When libcurl is asked to perform automatic gzip decompression of
  content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,
  **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would
  make libcurl perfor…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-120
  - CWE-680
vendor: netapp
product: hci_baseboard_management_controller
affected:
  - hci_baseboard_management_controller
  - hci_h610s_firmware
  - hci_h610c_firmware
  - hci_h615c_firmware
  - solidfire_&_hci_management_node
  - solidfire_&_hci_storage_node
  - 'curl >= 7.10.5, < 8.12.0'
  - 'libcurl >= 7.10.5, < 8.12.0'
patched:
  - curl 8.12.0
  - libcurl 8.12.0
published: '2025-02-05'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:17:22.237'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-0725'
references:
  - url: 'https://curl.se/docs/CVE-2025-0725.html'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://curl.se/docs/CVE-2025-0725.json'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://hackerone.com/reports/2956023'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'http://www.openwall.com/lists/oss-security/2025/02/05/3'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/02/06/2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/02/06/4'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/curl/curl/commit/76f83f0db23846e254d940ec7'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20250306-0009/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-089022.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.01264
epssPercentile: 0.6913
ingestedAt: '2026-10-15T03:30:12.782Z'
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2025-02-05T14:33:50.737849Z'
---

## Overview

When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,
**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would
make libcurl perform a buffer overflow.

## Affected

- `hci_baseboard_management_controller`
- `hci_h610s_firmware`
- `hci_h610c_firmware`
- `hci_h615c_firmware`
- `solidfire_&_hci_management_node`
- `solidfire_&_hci_storage_node`
- `curl >= 7.10.5, < 8.12.0`
- `libcurl >= 7.10.5, < 8.12.0`

## Remediation

Upgrade past the affected range:

- `curl 8.12.0`
- `libcurl 8.12.0`