Couchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates

MEDIO 4.9CVE-2025-49015 · GHSA-px2c-r924-mwcc · Published 18/06/2025 · updated 17/06/2026

En resumen

CVE-2025-49015 es una vulnerabilidad MEDIO (CVSS 4.9) que afecta a CouchbaseNetClient, .net sdk (couchbase).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.23%, mayor que el 13.8% de las vulnerabilidades.
Solución: actualizar a 3.7.1 o posterior.

Package	Affected versions	Patched versions
CouchbaseNetClient NuGet	`< 3.7.1`	`3.7.1`
.net sdk couchbase	`≤ 3.7.1`	No fix yet

Description

The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2025-49015 · ADVISORY
couchbase/couchbase-net-client commit 04d1679 · WEB
docs.couchbase.com/server/current/release-notes/relnotes.html · WEB
forums.couchbase.com/tags/security · WEB
couchbase/couchbase-net-client · PACKAGE
couchbase.com/alerts · WEB
couchbase.com/alerts · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free