PT-2025-26166 · Couchbase · Couchbase .Net Sdk

Published 2025-06-18 · Updated 2025-07-09 · CVE-2025-49015

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Couchbase .NET SDK versions prior to 3.7.1

Description The issue concerns the Couchbase .NET SDK's failure to properly enable hostname verification for TLS certificates. Additionally, the SDK was using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.

Recommendations For versions prior to 3.7.1, update to version 3.7.1 or later to resolve the issue. As a temporary workaround, consider disabling the use of IP addresses and ensure that hostname verification is properly enabled for TLS certificates. Restrict access to sensitive data until the update is applied to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-297

Related Identifiers

CVE-2025-49015

GHSA-PX2C-R924-MWCC

Affected Products

Couchbase .Net Sdk

References · 11

• https://osv.dev/vulnerability/CVE-2025-49015 · Vendor Advisory
• https://couchbase.com/alerts · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-px2c-r924-mwcc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49015 · Security Note
• https://github.com/couchbase/couchbase-net-client/commit/04d1679b2178f922036be6e595b3d91f972c5ba3 · Note
• https://github.com/couchbase/couchbase-net-client · Note
• https://forums.couchbase.com/tags/security · Note
• https://t.me/cvenotify/128243 · Telegram Post
• https://t.me/cvetracker/26509 · Telegram Post
• https://docs.couchbase.com/server/current/release-notes/relnotes.html · Note
• https://twitter.com/CVEnew/status/1935727417764573497 · Twitter Post