Medium severity · published Jan 8, 2026
CVE-2025-14017
broken TLS options for threaded LDAPS
6.3
CVSS
0.1%
EPSS
No
On KEV
Description
When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,
changing TLS options in one thread would inadvertently change them globally
and therefore possibly also affect other concurrently setup transfers.
Disabling certificate verification for a specific transfer could
unintentionally disable the feature for other threads as well.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
curl · curl
7.17.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.18.0; ccba0d10b6baf5c73cae8cf4fb3f29f0f55c5a34 before 39d1976b7f709a516e3243338ebc0443bdd8d56d; 8.17.0; 8.16.0; +34 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14017
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14017
Vendor Advisory
https://curl.se/docs/CVE-2025-14017.html
Vendor Advisory
https://curl.se/docs/CVE-2025-14017.json
Mailing List
http://www.openwall.com/lists/oss-security/2026/01/07/3
More from curl
9.8
CVE-2026-19931
Negotiate ambient user conn reuse
9.8
CVE-2026-9079
stale proxy password leak
9.8
CVE-2026-8925
SASL double-free
9.8
CVE-2026-11856
cross-origin Digest auth state leak
9.8
CVE-2026-10536
HTTP/2 stream-dependency tree UAF