Integer Overflow Vulnerability in libcurl Affecting HTTP Response Decompression
CVE-2025-0725
7.3HIGH
What is CVE-2025-0725?
An integer overflow vulnerability exists in libcurl when handling automatic gzip decompression of HTTP responses for specific versions of zlib. If libcurl is configured with the CURLOPT_ACCEPT_ENCODING option and uses zlib version 1.2.0.3 or older, an attacker may exploit this flaw to manipulate the input, leading to a buffer overflow condition. This could potentially allow for unauthorized access or execution of arbitrary code within the affected application.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
curl 8.11.1
curl 8.11.0
curl 8.10.1
References
CVSS V3.1
Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
z2_
Daniel Stenberg