Integer Overflow Vulnerability in libcurl Affecting HTTP Response Decompression

CVE-2025-0725

What is CVE-2025-0725?

An integer overflow vulnerability exists in libcurl when handling automatic gzip decompression of HTTP responses for specific versions of zlib. If libcurl is configured with the CURLOPT_ACCEPT_ENCODING option and uses zlib version 1.2.0.3 or older, an attacker may exploit this flaw to manipulate the input, leading to a buffer overflow condition. This could potentially allow for unauthorized access or execution of arbitrary code within the affected application.

References