CVE-2025-14017: broken TLS options for threaded LDAPS

Security readout for executives and security teams

CVE-2025-14017 affects curl/libcurl when LDAPS transfers are used concurrently across threads. A TLS option change made for one threaded LDAPS transfer could leak into global state and affect other transfers being set up at the same time. The main risk is that disabling certificate verification for one transfer could unintentionally disable certificate verification for another concurrent LDAPS transfer. Exposure is most likely in applications or services that use affected curl/libcurl versions for LDAP over TLS and perform LDAPS transfers from multiple threads. Risk is higher where application logic sometimes disables TLS certificate verification for a specific transfer. Simple single-threaded curl use, non-LDAPS protocols, or deployments that never alter LDAPS TLS verification settings are less likely to be exposed based on the provided description. Medium priority. Treat as important for systems that use multi-threaded LDAPS through libcurl, especially identity, directory, authentication, or administrative tooling. Lower priority for systems that do not use LDAPS or do not use threaded libcurl transfer setup. Mitigation focus: Inventory applications, containers, and operating system packages that include curl or link against libcurl.; Prioritize systems that use LDAPS with libcurl in multi-threaded code paths.; Check curl vendor guidance and operating system or distribution advisories for the fixed version or backported patch; the bundle does not provide explicit patch-version evidence..

Prepared

Apr 30, 2026, 05:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.