IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.3Alta

CVE-2025-0725gzip integer overflow

curl curl; Siemens RUGGEDCOM RST2428P; Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family; Siemens SCALANCE XCH328 Publicada: (hace 1 año)

Descripción

When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.

Debilidad (CWE): CWE-680CWE-120

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
curl curl 8.11.1 – ≤ 8.11.1, 8.11.0 – ≤ 8.11.0, 8.10.1 – ≤ 8.10.1, 8.10.0 – ≤ 8.10.0, 8.9.1 – ≤ 8.9.1, 8.9.0 – ≤ 8.9.0, 8.8.0 – ≤ 8.8.0, 8.7.1 – ≤ 8.7.1, 8.7.0 – ≤ 8.7.0, 8.6.0 – ≤ 8.6.0, 8.5.0 – ≤ 8.5.0, 8.4.0 – ≤ 8.4.0, 8.3.0 – ≤ 8.3.0, 8.2.1 – ≤ 8.2.1, 8.2.0 – ≤ 8.2.0, 8.1.2 – ≤ 8.1.2, 8.1.1 – ≤ 8.1.1, 8.1.0 – ≤ 8.1.0, 8.0.1 – ≤ 8.0.1, 8.0.0 – ≤ 8.0.0, 7.88.1 – ≤ 7.88.1, 7.88.0 – ≤ 7.88.0, 7.87.0 – ≤ 7.87.0, 7.86.0 – ≤ 7.86.0, 7.85.0 – ≤ 7.85.0, 7.84.0 – ≤ 7.84.0, 7.83.1 – ≤ 7.83.1, 7.83.0 – ≤ 7.83.0, 7.82.0 – ≤ 7.82.0, 7.81.0 – ≤ 7.81.0, 7.80.0 – ≤ 7.80.0, 7.79.1 – ≤ 7.79.1, 7.79.0 – ≤ 7.79.0, 7.78.
haxx curl 7.10.5 – < 8.12.0
haxx libcurl 7.10.5 – < 8.12.0
netapp hci baseboard management controller —
netapp hci h610c firmware —
netapp hci h610s firmware —
netapp hci h615c firmware —
netapp solidfire & hci management node —
netapp solidfire & hci storage node —
Siemens RUGGEDCOM RST2428P < V3.3
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family < V3.3
Siemens SCALANCE XCH328 < V3.3
Siemens SCALANCE XCM324 < V3.3
Siemens SCALANCE XCM328 < V3.3
Siemens SCALANCE XCM332 < V3.3
Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) < V3.3
Siemens SCALANCE XRM334 (230 V AC, 12xFO) < V3.3
Siemens SCALANCE XRM334 (230 V AC, 8xFO) < V3.3
Siemens SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) < V3.3
Siemens SCALANCE XRM334 (24 V DC, 12xFO) < V3.3
Siemens SCALANCE XRM334 (24 V DC, 8xFO) < V3.3
Siemens SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) < V3.3
Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) < V3.3
Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) < V3.3
Siemens SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) < V3.3
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.0 – < V3.1.5
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.0 – < V3.1.5
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.0 – < V3.1.5

Referencias y parches

Coincidencias CPE (NVD) (8)
  • cpe:2.3:a:netapp:hci_baseboard_management_controller:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:hci_h610s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:hci_h610c_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:hci_h615c_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:solidfire_\&_hci_storage_node:-:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* ≥ 7.10.5 < 8.12.0
  • cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:* ≥ 7.10.5 < 8.12.0

CVE recientes del mismo producto — curl / libcurl

8.1Alta
CVE-2026-107929

local interface connection reuse mixup

curl curl

When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can sile…

8.1Alta
CVE-2026-107928

info leak uploading over WebSockets with GnuTLS

curl curl

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was gi…

7.5Alta
CVE-2026-94266

password leak in CURLINFO_EFFECTIVE_URL

curl curl

libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

9.1Crítica
CVE-2026-94265

Authorization: Negotiate sent to foreign origin

curl curl

When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect con…

7.5Alta
CVE-2026-92391

curl_mime_free stack overflow by recursion

curl curl

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traver…

1.2%EPSS
7.5Alta
CVE-2026-92390

-J no-clobber guarantee bypassed with 103 early hints

curl curl

When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` un…