Vulnerability · Published Jan 8, 2026 · Assigned by curl
CVE-2025-14819OpenSSL partial chain store policy bypass
Medium 5.3
In plain English
A medium-severity improper certificate validation in curl from curl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.21 | curl | 8.14.1-r3 | ALPINE-CVE-2025-14819 |
| Alpine:v3.22 | curl | 8.14.1-r4 | ALPINE-CVE-2025-14819 |
| Alpine:v3.23 | curl | 8.18.0-r0 | ALPINE-CVE-2025-14819 |
| Alpine:v3.24 | curl | 8.18.0-r0 | ALPINE-CVE-2025-14819 |
| Debian:12 | curl | 7.88.1-10+deb12u15 | DEBIAN-CVE-2025-14819 |
| Debian:13 | curl | 8.14.1-2+deb13u4 | DEBIAN-CVE-2025-14819 |
| Debian:14 | curl | 8.18.0~rc3-1 | DEBIAN-CVE-2025-14819 |
| Ubuntu:22.04:LTS | curl | 7.81.0-1ubuntu1.22 | USN-8062-1 |
| Ubuntu:24.04:LTS | curl | 8.5.0-2ubuntu10.7 | USN-8062-1 |
| Ubuntu:24.04:LTS | curl | 8.5.0-2ubuntu10.7 | UBUNTU-CVE-2025-14819 |
| Ubuntu:25.10 | curl | 8.14.1-2ubuntu1.1 | USN-8062-1 |
| Ubuntu:25.10 | curl | 8.14.1-2ubuntu1.1 | UBUNTU-CVE-2025-14819 |
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N