VDB
DEBIAN-CVE-2025-14819
DEBIAN-CVE-2025-14819
PUBLISHED
CVSS 5.300000190734863 MEDIUM
When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:12 | curl | 8.3.0-3, 7.88.1-10+deb12u1, 7.88.1-10+deb12u11 |
| Debian:14 | curl | 0, 8.14.1-2, * |
| Debian:13 | curl | 8.15.0-1, 8.15.0-1, 8.15.0-1 |
Exploit Intelligence
- vote.json (github-poc)
- 2026.xml (github-poc)
- 2026.xml (github-poc)
- glcve_test.go (github-poc)
Timeline
- Jan 8, 2026 CVE Published
- Apr 28, 2026 CVE Updated