CVE-2025-14819: OpenSSL partial chain store policy bypass
When doing TLS related transfers with reused easy or multi handles and altering the CURLSSLOPTNOPARTIALCHAIN option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14819?
CVE-2025-14819 has been classified with a severity that may impact the security of TLS transfers due to improper handling of CA store caches.
How do I fix CVE-2025-14819?
To fix CVE-2025-14819, update to the latest version of libcurl that addresses this vulnerability.
What is the impact of CVE-2025-14819 on TLS transfers?
CVE-2025-14819 can lead to the unintended reuse of CA store caches, potentially violating the user's security expectations.
Which versions of libcurl are affected by CVE-2025-14819?
CVE-2025-14819 affects all versions of libcurl that allow for TLS transfers while reusing handles with the altered CURLSSLOPT_NO_PARTIALCHAIN option.
Who should be concerned about CVE-2025-14819?
Developers and system administrators using affected versions of libcurl for TLS communications should be concerned about CVE-2025-14819.