LDAPS TLS Option Leak in libcurl (CVE-2025-14017)
CVE-2025-14017 Published on January 8, 2026

broken TLS options for threaded LDAPS
When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.

NVD

Vulnerability Analysis

CVE-2025-14017 can be exploited with local system access, requires user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
LOCAL
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

Unsynchronized Access to Shared Data in a Multithreaded Context

The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.


Products Associated with CVE-2025-14017

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2025-14017 are published in these products:

Haxx Curl
 
Canonical Ubuntu Linux
 
Oracle
 

Affected Versions

curl: curl: curl:

Exploit Probability

EPSS
0.12%
Percentile
1.44%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.