CVE-2025-0665

Haxx Curl vulnerability

7.0 HIGHPublic exploitEPSS 1.30%

Published5 Feb 2025

Description

libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityHigh

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityLow

IntegrityLow

AvailabilityHigh

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Affected products

Haxx Curl8.11.1

Netapp Bootstrap OSall versions

Netapp H300s Firmwareall versions

Netapp H410c Firmwareall versions

Netapp H410s Firmwareall versions

Netapp H500s Firmwareall versions

Netapp H700s Firmwareall versions

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

References

https://curl.se/docs/CVE-2025-0665.htmlVendor Advisory
https://curl.se/docs/CVE-2025-0665.jsonVendor Advisory
https://hackerone.com/reports/2954286ExploitIssue TrackingThird Party Advisory
https://security.netapp.com/advisory/ntap-20250306-0007/Third Party Advisory
http://www.openwall.com/lists/oss-security/2025/02/05/2Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2025/02/05/5Mailing ListThird Party Advisory

Frequently asked

Is CVE-2025-0665 being actively exploited?

CVE-2025-0665 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 1.30%.

How severe is CVE-2025-0665?

CVE-2025-0665 has a CVSS 3.1 base score of 7.0, rated high. EPSS estimates a 1.30% probability of exploitation.

Which products are affected by CVE-2025-0665?

Affected products include Haxx Curl, Netapp Bootstrap OS, Netapp H300s Firmware, Netapp H410c Firmware, Netapp H410s Firmware, and 2 more.

How do I fix CVE-2025-0665?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-0665 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.