---
id: CVE-2025-10966
title: |-
  curl's code for managing SSH connections when SFTP was done using the wolfSSH
  powered backend was flawed and missed host verification mechanisms.

  This prevents curl from detecting MITM attackers and more.
summary: |-
  curl's code for managing SSH connections when SFTP was done using the wolfSSH
  powered backend was flawed and missed host verification mechanisms.

  This prevents curl from detecting MITM attackers and more.
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-322
vendor: haxx
product: curl
affected:
  - 'curl >= 7.69.0, < 8.17.0'
patched:
  - curl 8.17.0
published: '2025-11-07'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T07:16:23.317'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-10966'
references:
  - url: 'https://curl.se/docs/CVE-2025-10966.html'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://curl.se/docs/CVE-2025-10966.json'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://hackerone.com/reports/3355218'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'http://www.openwall.com/lists/oss-security/2025/11/05/2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-253495.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-11-10T20:26:03.531168Z'
epss: 0.00399
epssPercentile: 0.3136
ingestedAt: '2026-09-15T07:33:29.256Z'
---

## Overview

curl's code for managing SSH connections when SFTP was done using the wolfSSH
powered backend was flawed and missed host verification mechanisms.

This prevents curl from detecting MITM attackers and more.

## Affected

- `curl >= 7.69.0, < 8.17.0`

## Remediation

Upgrade past the affected range:

- `curl 8.17.0`