CVE-2025-14017

MediumCVSS 6.3/10Last modified Sep 15, 2026

Description

When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers.

Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-567

Affected software

No affected versions have been published.

Timeline

Published: Jan 8, 2026
Last modified: Sep 15, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-140187.3Unquoted Search Path or Element vulnerability in NetBT Consulting Services Inc. E-Fatura allows Leveraging/Manipulating Configuration File S CVE-2025-140194.7LINE client for Android versions from 13.8 to 15.5 is vulnerable to UI spoofing in the in-app browser where a specific layout could obscure CVE-2025-14025.3The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the CVE-2025-140204.3LINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in the in-app browser where the full-screen security To CVE-2025-140214.3The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to exec CVE-2025-140226.8LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial CVE-2025-140234.3LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the navigation state and the in-app browser's user inte CVE-2025-140258.5A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gate CVE-2025-140267.8Forcepoint One DLP Client, version 23.04.5642 (and possibly newer versions), includes a restricted version of Python 2.5.4 that prevents use CVE-2025-140278.7Multiple denial-of-service vulnerabilities exist in the affected product. These issues can be triggered through various crafted inputs, incl CVE-2025-140284.4The Contact Us Simple Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and i CVE-2025-140295.3The Community Events plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_a