Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

curl on Debian 12 could let attackers execute code

CVE-2025-15079 · published today
Summary

The curl tool used on Debian 12 can be tricked into running malicious code, which could let an attacker take control of the system. This happens because of a flaw that has now been fixed in newer releases of curl. Apply the latest security update for curl as soon as possible to protect your servers.

What to do
  • Update debian rootio-curl to version 8.14.1-2+deb13u4.root.io.12.
  • Update debian rootio-curl to version 7.88.1-10+deb12u15.aikido.13.
  • Update debian rootio-curl to version 8.14.1-2+deb13u4.aikido.14.
  • Update debian rootio-curl to version 8.14.1-2+deb13u2.root.io.8.
  • Update debian rootio-curl to version 7.88.1-10+deb12u14.root.io.7.
  • Update debian rootio-curl to version 7.88.1-10+deb12u14.root.io.10.
  • Update debian rootio-curl to version 7.88.1-10+deb12u14.root.io.12.
  • Update debian rootio-curl to version 8.14.1-2+deb13u3.root.io.9.
  • Update debian rootio-curl to version 8.14.1-2+deb13u3.root.io.10.
  • Update debian rootio-curl to version 8.14.1-2+deb13u4.root.io.13.
  • Update debian curl to version 8.14.1-2+deb13u4.aikido.14.
  • Update curl to version 8.14.1-2+deb13u5.aikido.18.
  • Update rootio-curl to version 8.14.1-2+deb13u5.aikido.18.
  • Update curl to version 8.14.1-2+deb13u5.aikido.19.
  • Update rootio-curl to version 8.14.1-2+deb13u5.aikido.19.
  • Update debian curl to version 8.18.0~rc3-1.
  • Update curl to version 7.88.1-10+deb12u15.aikido.16.
  • Update rootio-curl to version 7.88.1-10+deb12u15.aikido.16.
  • Update curl to version 8.14.1-2+deb13u5.aikido.20.
  • Update rootio-curl to version 8.14.1-2+deb13u5.aikido.20.
  • Update curl to version 8.14.1-2+deb13u5.aikido.21.
  • Update rootio-curl to version 8.14.1-2+deb13u5.aikido.21.
  • Update curl to version 8.14.1-2+deb13u5.aikido.22.
  • Update rootio-curl to version 8.14.1-2+deb13u5.aikido.22.
  • Update curl to version 7.88.1-10+deb12u15.aikido.17.
  • Update rootio-curl to version 7.88.1-10+deb12u15.aikido.17.
  • Update curl to version 8.14.1-2+deb13u7.aikido.24.
  • Update rootio-curl to version 8.14.1-2+deb13u7.aikido.24.
  • Update curl to version 7.88.1-10+deb12u15.aikido.18.
  • Update rootio-curl to version 7.88.1-10+deb12u15.aikido.18.
  • Update curl to version 8.14.1-2+deb13u7.aikido.25.
  • Update rootio-curl to version 8.14.1-2+deb13u7.aikido.25.
  • Update curl to version 7.88.1-10+deb12u15.aikido.19.
  • Update rootio-curl to version 7.88.1-10+deb12u15.aikido.19.
  • Update curl to version 7.88.1-10+deb12u15.aikido.20.
  • Update rootio-curl to version 7.88.1-10+deb12u15.aikido.20.
  • Update haxx curl to version 8.18.0 or later.
Affected software
Ecosystem VendorProductAffected versions
– haxx curl >= 7.58.0, < 8.18.0
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
Root:Debian:13 debian rootio-curl < 8.14.1-2+deb13u4.root.io.12
< 8.14.1-2+deb13u4.aikido.14
< 8.14.1-2+deb13u2.root.io.8
< 8.14.1-2+deb13u3.root.io.9
< 8.14.1-2+deb13u3.root.io.10
< 8.14.1-2+deb13u4.root.io.13
Fix: upgrade to 8.14.1-2+deb13u4.root.io.12
Root:Debian:12 debian rootio-curl < 7.88.1-10+deb12u15.aikido.13
< 7.88.1-10+deb12u14.root.io.7
< 7.88.1-10+deb12u14.root.io.10
< 7.88.1-10+deb12u14.root.io.12
Fix: upgrade to 7.88.1-10+deb12u15.aikido.13
Alpine:v3.24 alpine curl >= 7.58.0
Root:Debian:13 debian curl < 8.14.1-2+deb13u4.aikido.14
Fix: upgrade to 8.14.1-2+deb13u4.aikido.14
Root:Debian:13 – curl < 8.14.1-2+deb13u5.aikido.18
< 8.14.1-2+deb13u5.aikido.19
< 8.14.1-2+deb13u5.aikido.20
< 8.14.1-2+deb13u5.aikido.21
< 8.14.1-2+deb13u5.aikido.22
< 8.14.1-2+deb13u7.aikido.24
< 8.14.1-2+deb13u7.aikido.25
Fix: upgrade to 8.14.1-2+deb13u5.aikido.18
Root:Debian:13 – rootio-curl < 8.14.1-2+deb13u5.aikido.18
< 8.14.1-2+deb13u5.aikido.19
< 8.14.1-2+deb13u5.aikido.20
< 8.14.1-2+deb13u5.aikido.21
< 8.14.1-2+deb13u5.aikido.22
< 8.14.1-2+deb13u7.aikido.24
< 8.14.1-2+deb13u7.aikido.25
Fix: upgrade to 8.14.1-2+deb13u5.aikido.18
– curl curl < 8.14.2
< adca486c125d9a6d9565b9607a19dce803a8b479
8.17.0
Debian:12 debian curl All versions
Debian:14 debian curl < 8.18.0~rc3-1
Fix: upgrade to 8.18.0~rc3-1
Root:Debian:12 – curl < 7.88.1-10+deb12u15.aikido.16
< 7.88.1-10+deb12u15.aikido.17
< 7.88.1-10+deb12u15.aikido.18
< 7.88.1-10+deb12u15.aikido.19
< 7.88.1-10+deb12u15.aikido.20
Fix: upgrade to 7.88.1-10+deb12u15.aikido.16
Root:Debian:12 – rootio-curl < 7.88.1-10+deb12u15.aikido.16
< 7.88.1-10+deb12u15.aikido.17
< 7.88.1-10+deb12u15.aikido.18
< 7.88.1-10+deb12u15.aikido.19
< 7.88.1-10+deb12u15.aikido.20
Fix: upgrade to 7.88.1-10+deb12u15.aikido.16
Original advisory text
CVE-2025-15079 in curl - Patched by Root
Root has patched CVE-2025-15079 in the curl package for Root:Debian:12. Multiple fixed versions available.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-297Improper Validation of Certificate with Host Mismatch
Timeline
Published4 Nov 2026
Updated4 Nov 2026
First seen7 Mar 2026
Sources
ROOT-OS-DEBIAN-13-CVE-2025-15079 · OSV
CVE-2025-15079 · NVD
CURL-CVE-2025-15079 · OSV
ROOT-OS-DEBIAN-12-CVE-2025-15079 · OSV
ALPINE-CVE-2025-15079 · OSV
CVE-2025-15079 · MITRE
CVE-2025-15079 · OSV
DEBIAN-CVE-2025-15079 · OSV
Track software like this
Free during beta