Vulnerability Report

CVE-2025-14017

Title: TLS Option Alteration in libcurl with multi-threaded LDAPS

Other

Proof Of Concept

No public PoC currently indexed for CVE-2025-14017.

CWE Category NVD-CWE-noinfo

Published Date Jan 08, 2026

Modified Date Jan 27, 2026

Exploit Status Not Found

Score 6.3 CVSS v

Exploit Probability (EPSS)

0.11%

Vulnerability Summary

CVE-2025-14017: When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.

Impacted Vendors

daniel_stenberg 1

haxx 1

Reference Links

https://curl.se/docs/CVE-2025-14017.html https://curl.se/docs/CVE-2025-14017.json

CVSS v3.1

Source Entity 134c704f-9b21-4f2e-91b3-4a467353bcc0

Severity MEDIUM

6.3

Attack Vector

LOCAL

Complexity

HIGH

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns