CVE-2025-10966
Low
No strong exploitation signal.
CVSS base
4.3
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS — probability of exploitation (30 days)
0.4%
33.9th percentile
CISA KEV
Not listed
Weakness / dates
CWE-322
Published 2025-11-07 · modified 2026-09-15
CVSS breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
| Attack Vector | N | Network |
| Attack Complexity | L | Low |
| Privileges Required | L | Low |
| User Interaction | N | None |
| Scope | U | Unchanged |
| Confidentiality | L | Low |
| Integrity | N | None |
| Availability | N | None |
Timeline
- 2025-11-07 — Published (NVD)
- 2026-09-15 — Last modified (NVD)
Description
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.