high7.3
CVE-2025-0725
When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3…
Impact
When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Netapp | Hci Baseboard Management Controller | All versions |
| Netapp | Hci H610s Firmware | All versions |
| Netapp | Hci H610c Firmware | All versions |
| Netapp | Hci H615c Firmware | All versions |
| Netapp | Solidfire \& Hci Management Node | All versions |
| Netapp | Solidfire \& Hci Storage Node | All versions |
| Haxx | Curl | from 7.10.5 before 8.12.0 |
| Haxx | Libcurl | from 7.10.5 before 8.12.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://curl.se/docs/CVE-2025-0725.html
- https://curl.se/docs/CVE-2025-0725.json
- https://hackerone.com/reports/2956023
- http://www.openwall.com/lists/oss-security/2025/02/05/3
- http://www.openwall.com/lists/oss-security/2025/02/06/2
- http://www.openwall.com/lists/oss-security/2025/02/06/4
- https://github.com/curl/curl/commit/76f83f0db23846e254d940ec7
- https://security.netapp.com/advisory/ntap-20250306-0009/
- https://cert-portal.siemens.com/productcert/html/ssa-089022.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html