CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

CVE details

CVE-2025-10966

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

Score
4.3 medium
Published
2025-11-07
Links
NVD · cve.org

Affected ports (1)

PortPackageVersionStatusMaintainer
ftp/linux-rl9-curllinux-rl9-curl7.76.1_13unaddressedemulation@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>linux-rl9-curl</name>
	<range><lt>8.17.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>curl's code for managing SSH connections when SFTP was done using the
	wolfSSH
powered backend was flawed and missed host verification
	mechanisms.

This prevents curl from detecting MITM attackers and
	more.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2025-10966</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-10966</url>
    </references>
    <dates>
      <discovery>2025-11-07</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>