#curl 8.18.0 has been released. This release fixes 1 medium and 5 low level vulnerabilities:
- CVE-2025-14017: broken TLS options for threaded LDAPS https://curl.se/docs/CVE-2025-14017.html
- CVE-2025-14524: bearer token leak on cross-protocol redirect https://curl.se/docs/CVE-2025-14524.html
- CVE-2025-14819: OpenSSL partial chain store policy bypass https://curl.se/docs/CVE-2025-14819.html
- CVE-2025-15079: libssh global knownhost override https://curl.se/docs/CVE-2025-15079.html
- CVE-2025-15224: libssh key passphrase bypass without agent set https://curl.se/docs/CVE-2025-15224.html
I discovered the last 2 vulnerabilities.
Download curl 8.18.0 from https://curl.se/download.html
#vulnerabilityresearch #vulnerability #cybersecurity #infosec
Harry Sintonen
npub1te…cpgc3
2026-01-07 07:51:27 UTC
Author Public Key
npub1te8autgg59arf0mh8smt34fup3780r5eskhedt360njqfw3hd9qqkcpgc3Seen on
wss://relay.momostr.pinkPublished at
2026-01-07 07:51:27 UTCEvent JSON
{
"id": "8779cc87b3811bf53d022e53afbe6f6d3044ea87efd97532d9c1dcc3963ba6c2",
"pubkey": "5e4fde2d08a17a34bf773c36b8d53c0c7c778e9985af96ae3a7ce404ba376940",
"created_at": 1767772287,
"kind": 1,
"tags": [
[
"t",
"curl"
],
[
"t",
"vulnerability"
],
[
"t",
"cybersecurity"
],
[
"proxy",
"https://infosec.exchange/@harrysintonen/115852724607348302",
"web"
],
[
"t",
"infosec"
],
[
"t",
"vulnerabilityresearch"
],
[
"proxy",
"https://infosec.exchange/users/harrysintonen/statuses/115852724607348302",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/harrysintonen/statuses/115852724607348302",
"pink.momostr"
],
[
"-"
]
],
"content": "#curl 8.18.0 has been released. This release fixes 1 medium and 5 low level vulnerabilities:\n- CVE-2025-14017: broken TLS options for threaded LDAPS https://curl.se/docs/CVE-2025-14017.html\n- CVE-2025-14524: bearer token leak on cross-protocol redirect https://curl.se/docs/CVE-2025-14524.html\n- CVE-2025-14819: OpenSSL partial chain store policy bypass https://curl.se/docs/CVE-2025-14819.html\n- CVE-2025-15079: libssh global knownhost override https://curl.se/docs/CVE-2025-15079.html\n- CVE-2025-15224: libssh key passphrase bypass without agent set https://curl.se/docs/CVE-2025-15224.html\n\nI discovered the last 2 vulnerabilities.\n\nDownload curl 8.18.0 from https://curl.se/download.html\n\n#vulnerabilityresearch #vulnerability #cybersecurity #infosec",
"sig": "8cf04da9da970c43756aa8f9e71666a2b3033e8f42f790f73280c06e5f9db9c05e38bff09bc4cf918c982f818fe2da0c38a641277c25d446772155275a3f53b7"
}