CVE-2025-10966: missing SFTP host verification with wolfSSH
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.
This prevents curl from detecting MITM attackers and more.
Other sources
missing SFTP host verification with wolfSSH
— Microsoft
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10966?
CVE-2025-10966 is classified as a high severity vulnerability due to its potential to facilitate MITM attacks.
How do I fix CVE-2025-10966?
To fix CVE-2025-10966, ensure you update curl to the latest version where the flaw in SSH connection management is addressed.
What type of attack can CVE-2025-10966 facilitate?
CVE-2025-10966 can facilitate man-in-the-middle (MITM) attacks by failing to verify the host during SFTP connections.
Which versions of curl are affected by CVE-2025-10966?
CVE-2025-10966 affects all versions of curl using the wolfSSH powered backend for SFTP.
Is user data at risk due to CVE-2025-10966?
Yes, user data can be at risk due to CVE-2025-10966 as it allows attackers to intercept and manipulate data during SFTP sessions.