CVE-2025-14819 OpenSSL partial chain store policy bypass
Attackers can bypass TLS partial chain restrictions in libcurl by reusing handles, potentially accepting untrusted certificates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-14819?
CVE-2025-14819 is a medium-severity vulnerability in Haxx Curl, published on 8 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.
Weakness: CWE-295
Which versions are affected by CVE-2025-14819?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2025-14819?
Upgrade to a fixed version.
Is CVE-2025-14819 being exploited?
There is no known exploitation of CVE-2025-14819 in the wild and no public exploit code.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2025-14819, BELL-CVE-2025-14819, CURL-CVE-2025-14819, DEBIAN-CVE-2025-14819, ECHO-2c28-953d-b5a0, GHSA-vqhr-m87q-9jqh and 4 more.