CURL-CVE-2025-14017: broken TLS options for threaded LDAPS

Published Jan 8, 2026

Updated

When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers.

Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.

Affected Software

1 affected component

curl libcurl

Event History

Jan 8, 2026

CVE Published

via OSV·10:07 AM

Data Sourced

via OSV·10:07 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue affects applications performing multi-threaded LDAPS transfers with libcurl when TLS options are changed in one thread while other transfers are being set up concurrently.

What TLS setting creates the most significant risk?

Disabling certificate verification for one specific transfer can inadvertently disable certificate verification for transfers being configured in other threads.

Does this require network access or credentials to trigger?

The supplied severity data lists local attack vector, high attack complexity, no privileges required, and user interaction required. The described condition is concurrent LDAPS use with TLS options changed in one thread.

CURL-CVE-2025-14017: broken TLS options for threaded LDAPS

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What TLS setting creates the most significant risk?

Does this require network access or credentials to trigger?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What TLS setting creates the most significant risk?

Does this require network access or credentials to trigger?