CVE-2025-0665
📋 TL;DR
libcurl incorrectly closes the same eventfd file descriptor twice during threaded name resolution cleanup, causing a use-after-free condition. This vulnerability affects applications using libcurl with threaded DNS resolution enabled, potentially allowing remote code execution or denial of service.
💻 Affected Systems
- libcurl
- curl command-line tool
- Applications linking against libcurl
📦 What is this software?
Curl by Haxx
curl is a command-line tool and library for transferring data with URLs. It supports numerous protocols including HTTP, HTTPS, FTP, and more, making it essential for API testing, web scraping, and automated data transfers.
Learn more about Curl →⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or persistent backdoor installation.
Likely Case
Application crash or denial of service affecting curl-dependent services, potentially disrupting web requests or API calls.
If Mitigated
Limited impact with proper sandboxing and privilege separation, potentially only causing isolated process crashes.
🎯 Exploit Status
Exploitation requires triggering threaded DNS resolution with specific timing conditions. No public exploits confirmed as of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libcurl 8.11.0
Vendor Advisory: https://curl.se/docs/CVE-2025-0665.html
Restart Required: Yes
Instructions:
1. Update libcurl to version 8.11.0 or later. 2. Rebuild applications linking against libcurl. 3. Restart affected services using libcurl.
🔧 Temporary Workarounds
Disable threaded DNS resolution
allConfigure libcurl to use synchronous DNS resolution instead of threaded resolver
curl_easy_setopt(curl, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4)
Or compile libcurl without CURLRES_THREADED support
🧯 If You Can't Patch
- Implement network segmentation to isolate curl-dependent services
- Use application sandboxing (seccomp, containers) to limit impact of potential exploitation
🔍 How to Verify
Check if Vulnerable:
Check libcurl version: curl --version | head -1. If version is between 8.9.0 and 8.10.0 inclusive, check if built with threaded resolver support.Check Version:
curl --version | head -1Verify Fix Applied:
Verify libcurl version is 8.11.0 or higher: curl --version | grep -E '^curl.*8\.(1[1-9]|[2-9][0-9])'📡 Detection & Monitoring
Log Indicators:
- Segmentation faults in curl processes
- Unexpected process termination of curl-dependent applications
- Kernel logs showing use-after-free events
Network Indicators:
- Unusual DNS query patterns from applications using libcurl
- Failed HTTP requests from curl-dependent services
SIEM Query:
process.name:"curl" AND event.action:"segmentation_fault" OR process.exit_code:139