Is CVE-2025-14819 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-14819 being exploited in the wild.

How severe is CVE-2025-14819?

Medium severity, with a CVSS score of 5.3, published 8 January 2026.

Which products and versions are affected?

curl libcurl 7.87.0 through 8.17.0 (multiple fix branches: fixed in 8.14.2, 8.16.1, 8.18.0).

Is there a fix for CVE-2025-14819?

A patch was published on 2026-01-07: curl 8.18.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-14819 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-14819?

Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-14819: curl libcurl certificate validation bypass in OpenSSL backend

CVE-2025-14819 · Severity: medium · CVSS 5.3 · Published 2026-01-08

libcurl is a widely-used library for making network requests in applications. When reusing connections with OpenSSL and toggling certificate chain validation settings, libcurl could incorrectly accept partial certificate chains that should have been rejected, potentially allowing fraudulent or compromised TLS certificates. This could lead to man-in-the-middle attacks and unauthorized access to sensitive data transmitted over HTTPS.

Technologies: Haxx Curl. Vendors: Haxx.

Quick answers

Is CVE-2025-14819 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-14819 being exploited in the wild.
How severe is CVE-2025-14819?: Medium severity, with a CVSS score of 5.3, published 8 January 2026.
Which products and versions are affected?: curl libcurl 7.87.0 through 8.17.0 (multiple fix branches: fixed in 8.14.2, 8.16.1, 8.18.0).
Is there a fix for CVE-2025-14819?: A patch was published on 2026-01-07: curl 8.18.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-14819 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-14819?: Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper certificate validation issue (CWE-295) in libcurl's OpenSSL backend. When the CURLSSLOPT_NO_PARTIALCHAIN option is toggled between transfers using reused easy or multi handles, libcurl may incorrectly reuse a cached CA store in memory with the opposite partial-chain policy flag set, causing it to accept certificate chains it should reject. This requires CA caching to be enabled (CURLOPT_CA_CACHE_TIMEOUT not set to zero) and only affects TLS transfers. No user interaction or authentication is required; however, the vulnerability only manifests when applications actively toggle this option between different transfer contexts, which is uncommon. Applications using fixed certificate validation policies are unaffected. The fix is available in curl 8.14.2, 8.16.1, 8.18.0 and later.

Affected products

curl libcurl 7.87.0 through 8.17.0 (multiple fix branches: fixed in 8.14.2, 8.16.1, 8.18.0)

Timeline

2026-01-07: disclosed: Public advisory released
2026-01-07: patched: curl 8.18.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.