When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.
History

Fri, 07 Mar 2025 01:30:00 +0000

Type Values Removed Values Added
References

Fri, 07 Feb 2025 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-680
References
Metrics threat_severity

None

threat_severity

Low


Thu, 06 Feb 2025 19:45:00 +0000

Type Values Removed Values Added
References

Thu, 06 Feb 2025 11:30:00 +0000

Type Values Removed Values Added
References

Wed, 05 Feb 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Wed, 05 Feb 2025 11:45:00 +0000

Type Values Removed Values Added
References

Wed, 05 Feb 2025 09:30:00 +0000

Type Values Removed Values Added
Description When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.
Title gzip integer overflow
References

cve-icon MITRE

Status: PUBLISHED

Assigner: curl

Published: 2025-02-05T09:18:20.468Z

Updated: 2025-03-07T00:10:50.268Z

Reserved: 2025-01-27T04:58:09.514Z

Link: CVE-2025-0725

cve-icon Vulnrichment

Updated: 2025-03-07T00:10:50.268Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-02-05T10:15:22.980

Modified: 2025-03-07T01:15:12.403

Link: CVE-2025-0725

cve-icon Redhat

Severity : Low

Publid Date: 2025-02-05T09:18:20Z

Links: CVE-2025-0725 - Bugzilla