CVE-2025-10966 missing SFTP host verification with wolfSSH
Attackers can perform man-in-the-middle attacks on SFTP connections using the wolfSSH backend due to missing host verification.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-10966?
CVE-2025-10966 is a medium-severity vulnerability in Haxx Curl, published on 7 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.
This prevents curl from detecting MITM attackers and more.
Weakness: CWE-322
Which versions are affected by CVE-2025-10966?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2025-10966?
Upgrade to a fixed version.
Is CVE-2025-10966 being exploited?
There is no known exploitation of CVE-2025-10966 in the wild and no public exploit code.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2025-10966, AZL-69748, AZL-69766, BELL-CVE-2025-10966, CURL-CVE-2025-10966, DEBIAN-CVE-2025-10966 and 6 more.