PT-2025-46001 · Julia · Curl Jll+1

Published 2025-10-10 · Updated 2025-10-10

OSV

An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT GSSAPI DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT GSSAPI DELEGATION option has been changed.

Related Identifiers

JLSEC-2025-30

Affected Products

Curl Jll

Libcurl Jll

References · 6

• https://osv.dev/vulnerability/JLSEC-2025-30 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW · Vendor Advisory
• https://hackerone.com/reports/1895135 · Note
• https://security.netapp.com/advisory/ntap-20230420-0010 · Note
• https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html · Note
• https://security.gentoo.org/glsa/202310-12 · Note