Key Exchange without Entity Authentication

Overview Affected versions of this package are vulnerable to Key Exchange without Entity Authentication in the SFTP implementation in the wolfSSH backend. An attacker can intercept or manipulate data in transit by performing a man-in-the-middle attack. Note: This issue affects only users that bui...

CVE-2025-10966 missing SFTP host verification with wolfSSH

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more...

CVE-2025-10966

The curl tool contains a flaw in its code for managing SSH connections when SFTP is performed using the wolfSSH powered backend. The root cause is that the software misses host verification mechanisms , which prevents the application from detecting man-in-the-middle (MITM) attackers. This vulnera...

CVE-2025-10966

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more...

CVE-2025-10966 missing SFTP host verification with wolfSSH

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more...

CVE-2025-10966

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more...

CVE-2025-10966: Key Exchange without Entity Authentication

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more...

curl security vulnerabilities

curl is a cURL open source tool for transferring data from or to a server. A security vulnerability exists in curl that stems from the lack of a host authentication mechanism when SFTP uses the wolfSSH backend, which could lead to a man-in-the-middle attack...

CURL-CVE-2025-10966 missing SFTP host verification with wolfSSH

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more...

missing SFTP host verification with wolfSSH

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more...

PT-2025-45413

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description The software lacks proper host verification when establishing SSH connections for SFTP operations using the wolfSSH backend. This flaw allows for man-in-the-middle MITM attacks to go undetected,...

CVE-2025-11625

Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials...

EUVD-2025-35174

Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials...

CVE-2025-11625

Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials...

CVE-2025-11625 Host verification bypass and credential leak

Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials...

CVE-2025-11625 Host verification bypass and credential leak

Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials...

CVE-2025-11625 Host verification bypass and credential leak

Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials...

CVE-2025-11625

The CVE-2025-11625 entry concerns wolfSSH (client) versions 1.4.20 and earlier with an improper host authentication flaw that can permit authentication bypass and leakage of client credentials. Multiple sources (NVD, Red Hat, EUVD, OSV, CVE list, CNVD, CIRCL, etc.) describe the issue across wolfS...

CVE-2025-11625

Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials...

PT-2025-42886

Name of the Vulnerable Software and Affected Versions wolfSSH versions prior to 1.4.20 Description An improper host authentication issue exists in wolfSSH clients. This allows bypassing host authentication and potentially leaking client credentials. Recommendations Update wolfSSH to version 1.4.2...