CVE-2025-0725

When libcurl is asked to perform automatic gzip decompression ofcontent-encoded HTTP responses with the CURLOPT_ACCEPT_ENCODING option,using zlib 1.2.0.3 or older , an attacker-controlled integer overflow wouldmake libcurl perform a buffer overflow.

CVE-2025-4947

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.