CVE-2025-14017: broken TLS options for threaded LDAPS

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-08 · updated 2026-09-15
Weakness: CWE-567

Description

When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.

Affected products

curl: from 7.17.0 before 8.18.0 — fixed in 8.18.0

How to fix

Upgrade to a fixed version: curl 8.18.0. Check the vendor advisory for mitigations.

References

https://curl.se/docs/CVE-2025-14017.html
https://curl.se/docs/CVE-2025-14017.json
http://www.openwall.com/lists/oss-security/2026/01/07/3

Get alerted when CVE-2025-14017 or the next vulnerability affects your stack