CVE-2025-14819

// CVE-2025-14819 Proof of Concept // This PoC demonstrates the CA store reuse vulnerability in libcurl #include <curl/curl.h> #include <stdio.h> int main(void) { CURL *easy_handle = curl_easy_init(); if (easy_handle) { // First request: Set NO_PARTIALCHAIN option curl_easy_setopt(easy_handle, CURLOPT_URL, "https://legitimate-site.com"); curl_easy_setopt(easy_handle, CURLOPT_SSL_OPTIONS, CURLSSLOPT_NO_PARTIALCHAIN); curl_easy_setopt(easy_handle, CURLOPT_CAINFO, "/path/to/ca-bundle.crt"); // Perform first request - CA store gets cached CURLcode res1 = curl_easy_perform(easy_handle); // Reset handle for reuse curl_easy_reset(easy_handle); // Second request: Remove NO_PARTIALCHAIN option curl_easy_setopt(easy_handle, CURLOPT_URL, "https://attacker-controlled-site.com"); curl_easy_setopt(easy_handle, CURLOPT_SSL_OPTIONS, 0); // No longer setting NO_PARTIALCHAIN curl_easy_setopt(easy_handle, CURLOPT_CAINFO, "/path/to/ca-bundle.crt"); // Vulnerability: Cached CA store may still have partial chain restrictions // This could allow acceptance of incomplete certificate chains CURLcode res2 = curl_easy_perform(easy_handle); curl_easy_cleanup(easy_handle); } return 0; } // Mitigation: Use separate handles for different SSL configurations // Or ensure SSL options are consistently applied across all requests

{"cve": {"id": "CVE-2025-14819", "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9", "published": "2026-01-08T10:15:46.730", "lastModified": "2026-01-20T14:51:26.263", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "When doing TLS related transfers with reused easy or multi handles and\naltering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user's wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.6, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-295"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.87.0", "versionEndExcluding": "8.18.0", "matchCriteriaId": "83978599-3111-4F13-BFAE-1B0423D8A75F"}]}]}], "references": [{"url": "https://curl.se/docs/CVE-2025-14819.html", "source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Vendor Advisory", "Mitigation", "Patch"]}, {"url": "https://curl.se/docs/CVE-2025-14819.json", "source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Vendor Advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2026/01/07/5", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory", "Mitigation", "Patch"]}]}}