PT-2025-46001 · Julia · Curl Jll+1

Publicado 2025-10-10 · Atualizado 2025-10-10

OSV

An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT GSSAPI DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT GSSAPI DELEGATION option has been changed.

Identificadores relacionados

JLSEC-2025-30

Produtos afetados

Curl Jll

Libcurl Jll

Referências · 6

• https://hackerone.com/reports/1895135 · Nota
• https://osv.dev/vulnerability/JLSEC-2025-30 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20230420-0010 · Nota
• https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html · Nota
• https://security.gentoo.org/glsa/202310-12 · Nota