Skip to content
OpenAdvisories
Medium ALAS2-2026-3173 6 CVEs

Moderate: curl security update (Amazon Linux 2)

Published Feb 16, 2026 · Updated Feb 18, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-15224: libssh key passphrase bypass without agent set NOTE: https://curl.se/docs/CVE-2025-15224.html NOTE: Introduced with: https://github.com/curl/curl/commit/c92d2e14cfb0db662f958effd2ac86f995cf1b5a (curl-7_58_0) NOTE: Fixed by: https://github.com/curl/curl/commit/16d5f2a5660c61cc27bd5f1c7f512391d1c927aa (curl-8_18_0) NOTE: Debian builds with libssh2 for SSH backend CVE-2025-15079: libssh global knownhost override NOTE: https://curl.se/docs/CVE-2025-15079.html NOTE: Introduced with: https://github.com/curl/curl/commit/c92d2e14cfb0db662f958effd2ac86f995cf1b5a (curl-7_58_0) NOTE: Fixed by: https://github.com/curl/curl/commit/adca486c125d9a6d9565b9607a19dce803a8b479 (rc-8_18_0-3, curl-8_18_0) NOTE: Debian builds with libssh2 for SSH backend CVE-2025-14819: OpenSSL partial chain store policy bypass NOTE: https://curl.se/docs/CVE-2025-14819.html NOTE: Introduced with: https://github.com/curl/curl/commit/3c16697ebd796f799227be293e8689aec5f8190d (curl-7_87_0) NOTE: Fixed by: https://github.com/curl/curl/commit/cd046f6c93b39d673a58c18648d8906e954c4f5d (rc-8_18_0-3, curl-8_18_0) CVE-2025-14524: bearer token leak on cross-protocol redirect NOTE: https://curl.se/docs/CVE-2025-14524.html NOTE: Introduced with: https://github.com/curl/curl/commit/06c1bea72faabb6fad4b7ef818aafaa336c9a7aa (curl-7_33_0) NOTE: Fixed by: https://github.com/curl/curl/commit/1a822275d333dc6da6043497160fd04c8fa48640 (rc-8_18_0-2, curl-8_18_0) CVE-2025-14017: broken TLS options for threaded LDAPS NOTE: https://curl.se/docs/CVE-2025-14017.html NOTE: Introduced with: https://github.com/curl/curl/commit/ccba0d10b6baf5c73cae8cf4fb3f29f0f55c5a34 (curl-7_17_0) NOTE: Fixed by: https://github.com/curl/curl/commit/39d1976b7f709a516e3243338ebc0443bdd8d56d (rc-8_18_0-1, curl-8_18_0) NOTE: Built with OpenLDAP (only affects the legacy LDAP support) CVE-2025-10966: curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 curl 0:8.3.0-1.amzn2.0.12
Amazon Linux · 2 curl-debuginfo 0:8.3.0-1.amzn2.0.12
Amazon Linux · 2 libcurl 0:8.3.0-1.amzn2.0.12
Amazon Linux · 2 libcurl-devel 0:8.3.0-1.amzn2.0.12

Vulnerabilities 6

  • Medium 6.3
    CVE-2025-14017

    broken TLS options for threaded LDAPS

    When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2025-14524

    bearer token leak on cross-protocol redirect

    When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2025-14819

    OpenSSL partial chain store policy bypass

    When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishe…

    curl curl curl curl Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2025-15079

    libssh global known_hosts override

    When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.

    curl curl curl curl Debian Ubuntu
  • Medium 4.3
    CVE-2025-10966

    missing SFTP host verification with wolfSSH

    curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

    curl curl curl curl Debian Azure Linux Alpine
  • Low 3.1
    CVE-2025-15224

    libssh key passphrase bypass without agent set

    When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.

    curl curl curl curl Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-10966.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-14017.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-14524.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-14819.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-15079.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-15224.html