PT-2025-5691 · Libcurl+5 · Libcurl+5
Daniel Stenberg
·
Published
2025-01-23
·
Updated
2026-05-18
·
CVE-2025-0725
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
libcurl versions using zlib 1.2.0.3 or older
Description:
The issue is related to automatic gzip decompression of content-encoded HTTP responses with the
CURLOPT ACCEPT ENCODING option. An attacker-controlled integer overflow can cause libcurl to perform a buffer overflow when using zlib 1.2.0.3 or older. This can potentially allow a remote attacker to bypass the ASLR protection mechanism, execute arbitrary code, or cause a denial of service.Recommendations:
For libcurl versions using zlib 1.2.0.3 or older, consider disabling the
CURLOPT ACCEPT ENCODING option as a temporary workaround until a patch is available. Restrict access to the vulnerable zlib library to minimize the risk of exploitation. Avoid using the CURLOPT ACCEPT ENCODING option with zlib versions 1.2.0.3 or older until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
DoS
Buffer Overflow
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Debian
Red Os
Suse
Libcurl
Zlib