Integer Overflow Vulnerability in curl Package Leading to Buffer Overflow
Summary
CVE-2025-0725: When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the CURLOPT_ACCEPT_ENCODING option, using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would make lib... Affects curl across 2 version ranges.
< 8.12.0-r0
< 76f83f0db23846e254d940ec7
Fixed in 8.12.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
curl is a widely used command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, HTTPS, FTP, and more. curl is known for its versatility and is often utilized in web applications, APIs, and scripts for data retrieval and file transfers. However, certain versions of curl are vulnerable to an integer overflow issue when performing automatic gzip decompression of content-encoded HTTP responses, particularly when using zlib versions 1.2.0.3 or older.
Vulnerability Detail
The vulnerability, identified as CVE-2025-0725, arises when libcurl is configured to automatically decompress gzip-encoded HTTP responses using the CURLOPT_ACCEPT_ENCODING option. If the underlying zlib library is version 1.2.0.3 or older, an attacker can exploit an integer overflow, leading to a buffer overflow condition. This can potentially allow an attacker to execute arbitrary code or crash the application, posing a significant security risk.
How To Fix
Minimum fixed version
8.12.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable automatic gzip decompression by not setting the CURLOPT_ACCEPT_ENCODING option in their curl requests. This will prevent the vulnerability from being triggered, though it may affect the performance and efficiency of data transfers.
Conclusion
The CVE-2025-0725 vulnerability in the curl package poses a significant risk due to the potential for buffer overflow attacks. Users are strongly advised to update their curl installations to the latest patched versions and consider disabling gzip decompression as a temporary measure. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for curl →
FAQ
CVE-2025-0725 is a vulnerability in the curl package that can lead to a buffer overflow due to an integer overflow when decompressing gzip-encoded HTTP responses.
All versions of curl that utilize zlib 1.2.0.3 or older for gzip decompression are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If an immediate update is not possible, consider disabling gzip decompression in your curl requests as a temporary workaround.
More details about CVE-2025-0725 can be found in the official CVE database and security advisories related to the curl package.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
