CVE-2025-0725

HighCVSS 7.3/10Last modified Oct 15, 2026

Description

When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published: Feb 5, 2025
Last modified: Oct 15, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-07267.5In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause a denial of service by specially CVE-2025-07277.5In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subse CVE-2025-07287.5In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subse CVE-2025-07294.3A vulnerability was found in TP-Link TL-SG108E 1.0.0 Build 20201208 Rel. 40304. It has been rated as problematic. This issue affects some un CVE-2025-07303.7A vulnerability classified as problematic has been found in TP-Link TL-SG108E 1.0.0 Build 20201208 Rel. 40304. Affected is an unknown functi CVE-2025-07316.5An unauthenticated remote attacker can upload a .aspx file instead of a PV system picture through the demo account. The code can only be exe CVE-2025-07324.5A vulnerability, which was classified as problematic, has been found in Discord up to 1.0.9177 on Windows. Affected by this issue is some un CVE-2025-07334.5A vulnerability, which was classified as problematic, was found in Postman up to 11.20 on Windows. This affects an unknown part in the libra CVE-2025-07347.2A vulnerability has been found in y_project RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanNam CVE-2025-07365.5A flaw was found in Infinispan, when using JGroups with JDBC_PING. This issue occurs when an application inadvertently exposes sensitive inf CVE-2025-07396.5An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to sho CVE-2025-07406.5An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to o