{
  "cveId": "CVE-2025-10966",
  "url": "https://patchblox.com/security/cve/CVE-2025-10966",
  "summary": "CVE-2025-10966 is fixed in 10 products on 1 platform, first by DEBIAN-CVE-2025-10966, released November 7, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "missing SFTP host verification with wolfSSH",
  "description": "curl\u0027s code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.  This prevents curl from detecting MITM attackers and more.",
  "published": "2025-11-07T08:15:39Z",
  "severity": "Moderate",
  "cvss": 6.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "epss": 0.00427,
  "epssPercentile": 0.37236,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-10966",
  "fixes": [
    {
      "platform": "linux",
      "product": "curl",
      "release": "Debian 14",
      "fixedVersion": "8.17.0~rc2-1",
      "fix": "DEBIAN-CVE-2025-10966",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-10966",
      "released": "2025-11-07T08:15:39Z"
    },
    {
      "platform": "linux",
      "product": "curl",
      "release": "amzn 2023",
      "fixedVersion": "8.15.0-4.amzn2023.0.1",
      "fix": "ALAS2023-2025-1351",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-1351",
      "released": "2026-01-07T18:41:00Z"
    },
    {
      "platform": "linux",
      "product": "curl-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "8.15.0-4.amzn2023.0.1",
      "fix": "ALAS2023-2025-1351",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-1351",
      "released": "2026-01-07T18:41:00Z"
    },
    {
      "platform": "linux",
      "product": "curl-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "8.15.0-4.amzn2023.0.1",
      "fix": "ALAS2023-2025-1351",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-1351",
      "released": "2026-01-07T18:41:00Z"
    },
    {
      "platform": "linux",
      "product": "curl-minimal",
      "release": "amzn 2023",
      "fixedVersion": "8.15.0-4.amzn2023.0.1",
      "fix": "ALAS2023-2025-1351",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-1351",
      "released": "2026-01-07T18:41:00Z"
    },
    {
      "platform": "linux",
      "product": "curl-minimal-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "8.15.0-4.amzn2023.0.1",
      "fix": "ALAS2023-2025-1351",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-1351",
      "released": "2026-01-07T18:41:00Z"
    },
    {
      "platform": "linux",
      "product": "libcurl",
      "release": "amzn 2023",
      "fixedVersion": "8.15.0-4.amzn2023.0.1",
      "fix": "ALAS2023-2025-1351",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-1351",
      "released": "2026-01-07T18:41:00Z"
    },
    {
      "platform": "linux",
      "product": "libcurl-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "8.15.0-4.amzn2023.0.1",
      "fix": "ALAS2023-2025-1351",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-1351",
      "released": "2026-01-07T18:41:00Z"
    },
    {
      "platform": "linux",
      "product": "libcurl-devel",
      "release": "amzn 2023",
      "fixedVersion": "8.15.0-4.amzn2023.0.1",
      "fix": "ALAS2023-2025-1351",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-1351",
      "released": "2026-01-07T18:41:00Z"
    },
    {
      "platform": "linux",
      "product": "libcurl-minimal",
      "release": "amzn 2023",
      "fixedVersion": "8.15.0-4.amzn2023.0.1",
      "fix": "ALAS2023-2025-1351",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-1351",
      "released": "2026-01-07T18:41:00Z"
    },
    {
      "platform": "linux",
      "product": "libcurl-minimal-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "8.15.0-4.amzn2023.0.1",
      "fix": "ALAS2023-2025-1351",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-1351",
      "released": "2026-01-07T18:41:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T13:31:49Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}