Skip to content
OpenAdvisories
Medium · 6.3 CVE-2025-14017 EUVD-2026-1581GHSA-jh4h-2cg6-889h

broken TLS options for threaded LDAPS

Published Jan 8, 2026 · Updated Sep 15, 2026 · Assigned by curl

Vendor: curl Product: curl Package: cmake Package: curl Package: curl Package: curl Package: curl Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,
changing TLS options in one thread would inadvertently change them globally
and therefore possibly also affect other concurrently setup transfers.

Disabling certificate verification for a specific transfer could
unintentionally disable the feature for other threads as well.

Affected products

VendorProductAffectedFixed
curl curl 7.17.0 – < 8.14.2, 8.15.0 – < 8.16.1, 8.17.0 – < 8.18.0, 8.17.0, 8.16.0, 8.15.0, 8.14.1, 8.14.0, 8.13.0, 8.12.1, 8.12.0, 8.11.1, 8.11.0, 8.10.1, 8.10.0, 8.9.1, 8.9.0, 8.8.0, 8.7.1, 8.7.0, 8.6.0, 8.5.0, 8.4.0, 8.3.0, 8.2.1, 8.2.0, 8.1.2, 8.1.1, 8.1.0, 8.0.1, 8.0.0, 7.88.1, 7.88.0, 7.87.0, 7.86.0, 7.… 8.14.2

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 curl 8.18.0~rc2-1 —
Debian 13 curl No fix yet —
Debian 12 curl No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 curl 8.14.1-2ubuntu1.1 USN-8062-1
Ubuntu 24.04 LTS curl 8.5.0-2ubuntu10.7 USN-8062-1
Ubuntu 22.04 LTS curl 7.81.0-1ubuntu1.22 USN-8062-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS curl 7.68.0-1ubuntu2.25+esm2 —
Ubuntu Pro 18.04 LTS curl 7.58.0-2ubuntu3.24+esm7 —
Ubuntu Pro 16.04 LTS curl 7.47.0-1ubuntu2.19+esm15 —
Ubuntu Pro 14.04 LTS curl 7.35.0-1ubuntu2.20+esm19 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 curl +3 8.19.0-3.hum1 RHSA-2026:82895, RHSA-2026:77255, RHSA-2026:6893

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 curl 8.14.1-150700.7.11.1 SUSE-SU-2026:0221-1
SLES 12 SP5 curl 8.0.1-11.114.1 SUSE-SU-2026:0119-1
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 curl +1 8.14.1-160000.4.1 SUSE-SU-2026:20082-1
SLES 16.0 curl +1 8.14.1-160000.4.1 SUSE-SU-2026:20082-1
SLE Micro 6.2 curl 8.14.1-160000.4.1 SUSE-SU-2026:20110-1
SLE Micro 6.1 curl 8.14.1-slfo.1.1_5.1 SUSE-SU-2026:20358-1
SLE Micro 6.0 curl 8.14.1-4.1 SUSE-SU-2026:20347-1
SLE Micro 5.5 curl 8.14.1-150400.5.77.1 SUSE-SU-2026:0508-1
SLE Micro 5.4 curl 8.14.1-150400.5.77.1 SUSE-SU-2026:0508-1
SLE Micro 5.3 curl 8.14.1-150400.5.77.1 SUSE-SU-2026:0508-1
SLE Micro 5.2 curl 8.14.1-150200.4.100.1 SUSE-SU-2026:0078-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed curl 8.18.0-1.1 openSUSE-SU-2026:10017-1
openSUSE Leap 16.0 curl 8.14.1-160000.4.1 openSUSE-SU-2026:20031-1
openSUSE Leap 15.6 curl 8.14.1-150600.4.37.1 SUSE-SU-2026:0077-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 curl 8.18.0-r0 —
Alpine v3.23 curl 8.18.0-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 curl +4 8.17.0-1.amzn2023.0.1 ALAS2023-2026-1375
Amazon Linux 2 curl +2 8.3.0-1.amzn2.0.12 ALAS2-2026-3173

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 cmake 3.30.3-11 —
Azure Linux 3 curl 8.11.1-5 —
Azure Linux 2 (CBL-Mariner) cmake 3.21.4-21 —
Azure Linux 2 (CBL-Mariner) curl 8.8.0-8 —

Advisories 26

References