CVE-2025-0725

Description

When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.

References

https://hackerone.com/reports/2956023

https://curl.se/docs/CVE-2025-0725.json

https://curl.se/docs/CVE-2025-0725.html

http://www.openwall.com/lists/oss-security/2025/02/06/2

http://www.openwall.com/lists/oss-security/2025/02/05/3

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3