CVE-2025-49015 Couchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates
The Couchbase .NET SDK fails to verify TLS hostnames by default, allowing attackers to bypass certificate validation and potentially intercept traffic.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-49015?
CVE-2025-49015 is a medium-severity vulnerability in n/a, published on 18 Jun 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.
Weakness: CWE-297
Which versions are affected by CVE-2025-49015?
2 open source packages ship an affected version, including CouchbaseNetClient. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
CouchbaseNetClient NuGet | All versions | 3.7.1 |
CouchbaseNetClient NuGet | All versions | 3.7.1 |
Products include Couchbase .Net Sdk.
How do I fix CVE-2025-49015?
Upgrade CouchbaseNetClient to 3.7.1 or later.
Is CVE-2025-49015 being exploited?
There is no known exploitation of CVE-2025-49015 in the wild and no public exploit code.
Sources
Also known as GHSA-px2c-r924-mwcc.