CVE-2025-49015

The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates

Medium · published June 18, 2025

CVSS v3.1
4.9
EPSS
0%
Percentile
13.0
In the wild
Unconfirmed
What it is

The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00230 · 13.0th percentile
Published
2025-06-18T00:00Z
EPSS history
Timeline
  • 18 JUN 00:00Z
    The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates
    cvelistv5