Vulnerability · Published Jan 8, 2026 · Assigned by curl
CVE-2025-14017broken TLS options for threaded LDAPS
Medium 6.3
In plain English
A medium-severity security flaw in curl from curl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | curl | 8.18.0-r0 | ALPINE-CVE-2025-14017 |
| Alpine:v3.24 | curl | 8.18.0-r0 | ALPINE-CVE-2025-14017 |
| Debian:12 | curl | no fix listed | DEBIAN-CVE-2025-14017 |
| Debian:13 | curl | no fix listed | DEBIAN-CVE-2025-14017 |
| Debian:14 | curl | 8.18.0~rc2-1 | DEBIAN-CVE-2025-14017 |
| Ubuntu:22.04:LTS | curl | 7.81.0-1ubuntu1.22 | USN-8062-1 |
| Ubuntu:22.04:LTS | curl | 7.81.0-1ubuntu1.22 | UBUNTU-CVE-2025-14017 |
| Ubuntu:24.04:LTS | curl | 8.5.0-2ubuntu10.7 | USN-8062-1 |
| Ubuntu:24.04:LTS | curl | 8.5.0-2ubuntu10.7 | UBUNTU-CVE-2025-14017 |
| Ubuntu:25.10 | curl | 8.14.1-2ubuntu1.1 | UBUNTU-CVE-2025-14017 |
| Ubuntu:25.10 | curl | 8.14.1-2ubuntu1.1 | USN-8062-1 |
Affected products (as reported)
Weakness: CWE-567 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N