CVE-2025-0725: Haxx Curl

High severity, CVSS 7.3. EPSS: 1.3% chance of exploitation in the next 30 days.

When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.

Affected products

• Haxx Curl: from 7.10.5, before 8.12.0 (fixed in 8.12.0)
• Haxx Libcurl: from 7.10.5, before 8.12.0 (fixed in 8.12.0)
• Netapp Hci Baseboard Management Controller: affected versions not specified
• Netapp Hci h610c Firmware: affected versions not specified
• Netapp Hci h610s Firmware: affected versions not specified
• Netapp Hci h615c Firmware: affected versions not specified
• Netapp Solidfire & Hci Management Node: affected versions not specified
• Netapp Solidfire & Hci Storage Node: affected versions not specified

Published 2025-02-05. Last modified 2026-06-17.