Description
When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.
Affected products
haxx: curl
References3
- curl.se/docs/CVE-2025-14017.html Vendor Advisory
- curl.se/docs/CVE-2025-14017.json Vendor Advisory
- www.openwall.com/lists/oss-security/2026/01/07/3 Mailing ListThird Party Advisory
Metrics
- CVSS 3.1
-
6.3
MEDIUM
Score source: CNA
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - EPSS — exploit probability
- 0% percentile: 1 · as of 11 November 2026
- CWE
- CWE-567
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.