# CVE-2025-10966

## Summary

- **CVE ID:** CVE-2025-10966
- **Severity:** MEDIUM
- **CVSS Score:** 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **CWE:** CWE-322
- **Published:** Nov 7, 2025
- **Last Modified:** Sep 17, 2026

## Description

curl's code for managing SSH connections when SFTP was done using the wolfSSH
powered backend was flawed and missed host verification mechanisms.

This prevents curl from detecting MITM attackers and more.

## Affected Products

- curl — curl (8.16.0)
- curl — curl (8.15.0)
- curl — curl (8.14.1)
- curl — curl (8.14.0)
- curl — curl (8.13.0)
- curl — curl (8.12.1)
- curl — curl (8.12.0)
- curl — curl (8.11.1)
- curl — curl (8.11.0)
- curl — curl (8.10.1)
- curl — curl (8.10.0)
- curl — curl (8.9.1)
- curl — curl (8.9.0)
- curl — curl (8.8.0)
- curl — curl (8.7.1)
- curl — curl (8.7.0)
- curl — curl (8.6.0)
- curl — curl (8.5.0)
- curl — curl (8.4.0)
- curl — curl (8.3.0)
- curl — curl (8.2.1)
- curl — curl (8.2.0)
- curl — curl (8.1.2)
- curl — curl (8.1.1)
- curl — curl (8.1.0)
- curl — curl (8.0.1)
- curl — curl (8.0.0)
- curl — curl (7.88.1)
- curl — curl (7.88.0)
- curl — curl (7.87.0)
- curl — curl (7.86.0)
- curl — curl (7.85.0)
- curl — curl (7.84.0)
- curl — curl (7.83.1)
- curl — curl (7.83.0)
- curl — curl (7.82.0)
- curl — curl (7.81.0)
- curl — curl (7.80.0)
- curl — curl (7.79.1)
- curl — curl (7.79.0)
- curl — curl (7.78.0)
- curl — curl (7.77.0)
- curl — curl (7.76.1)
- curl — curl (7.76.0)
- curl — curl (7.75.0)
- curl — curl (7.74.0)
- curl — curl (7.73.0)
- curl — curl (7.72.0)
- curl — curl (7.71.1)
- curl — curl (7.71.0)
- curl — curl (7.70.0)
- curl — curl (7.69.1)
- curl — curl (7.69.0)
- curl — curl (6773c7ca65cf2183295e56603f9b86a5ce816a06)

## References

- [CNA](https://curl.se/docs/CVE-2025-10966.json)
- [CNA](https://curl.se/docs/CVE-2025-10966.html)
- [CNA](https://hackerone.com/reports/3355218)
- [CVE](http://www.openwall.com/lists/oss-security/2025/11/05/2)
- [siemens-SADP](https://cert-portal.siemens.com/productcert/html/ssa-253495.html)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.40%
- **EPSS Percentile:** 33.7

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-17._