CVE-2025-14017CWE-567

CVE-2025-14017

Medium · published January 8, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
1.4
In the wild
Unconfirmed
What it is

When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,

changing TLS options in one thread would inadvertently change them globally

and therefore possibly also affect other concurrently setup transfers.

Disabling certificate verification for a specific transfer could

unintentionally disable the feature for other threads as well.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00114 · 1.4th percentile
Weakness
CWE-567 · Unsynchronized Access to Shared Data in a Multithreaded Context
Published
2026-01-08T15:15Z
Affected products (1)
ProductVersionsFixed in
haxx/curl≥ 7.17.0, < 8.18.08.18.0
References (3)
EPSS history
Timeline
  • 08 JAN 10:07Z
    broken TLS options for threaded LDAPS
    cvelistv5