CVE-2025-4947

概要

参考情報

• curl.se/docs/CVE-2025-4947.html · Patch
• curl.se/docs/CVE-2025-4947.json · Vendor Advisory
• hackerone.com/reports/3150884 · Exploit
• openwall.com/lists/oss-security/2025/05/28/4 · Mailing List

curl のその他の脆弱性

• CVE-2026-82209高 8.2When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where t…
• CVE-2026-82208高 7.5With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silent…
• CVE-2026-80255高 7.5A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute c…
• CVE-2026-80231高 7.5A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store…
• CVE-2026-80230高 7.5When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CU…