CVE-2025-15079 curl CVE debrief

Who should care

Defenders and administrators using curl in environments with SSH-based transfers, especially those using SCP or SFTP, should assess exposure and verify configurations. They should prioritize verifying curl versions and configurations and update to a fixed version if possible. This includes reviewing and adjusting known_hosts settings for libssh and libcurl to ensure secure connections.

Why it matters

CVE-2025-15079 is a medium-severity vulnerability in libcurl that could allow mistaken connections to hosts not present in the specified known_hosts file. Defenders should prioritize verifying curl versions and configurations, especially in environments using SSH-based transfers with SCP or SFTP, and update to a fixed version if possible.

• Verify curl versions and configurations to prevent potential unauthorized connections
• Update to a fixed version to address the vulnerability
• Review and adjust known_hosts settings for libssh and libcurl to ensure secure connections

Technical summary

The vulnerability occurs when using SSH-based transfers with SCP or SFTP and setting the known_hosts file. libcurl could mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file. This issue affects curl versions from 7.58.0 to 8.18.0. The vulnerability is considered medium-severity with a CVSS score of 5.3. Defenders should prioritize verifying curl versions and configurations, especially in environments using SSH-based transfers with SCP or SFTP, and update to a fixed version if possible.

Defensive priority

Defenders should prioritize verifying curl versions and configurations, especially in environments using SSH-based transfers with SCP or SFTP, and update to a fixed version if possible.

Recommended defensive actions

• Verify curl versions and configurations, especially in environments using SSH-based transfers with SCP or SFTP
• Update to a fixed version if possible
• Review and adjust known_hosts settings for libssh and libcurl
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but specific exploitation instances or victim information are not provided. The vendor has released advisories and patches for the issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.