CVE-2025-0725 gzip integer overflow
An attacker can trigger a buffer overflow via integer overflow in libcurl's gzip decompression when using older zlib versions, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-0725?
CVE-2025-0725 is a high-severity vulnerability in Haxx Curl, published on 5 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.
Weakness: CWE-120
Which versions are affected by CVE-2025-0725?
It affects 8 products.
Products include Haxx Curl, Haxx Libcurl, Netapp Hci Baseboard Management Controller, Netapp Hci H610c Firmware, Netapp Hci H610s Firmware, Netapp Hci H615c Firmware and 2 more.
How do I fix CVE-2025-0725?
Upgrade to a fixed version.
Is CVE-2025-0725 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-0725 exists.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2025-0725, AZL-56471, AZL-56498, AZL-56504, CLEANSTART-2026-CU26814, CURL-CVE-2025-0725 and 7 more.