VYPR
← All advisories
Unrated severityNVD Advisory· Published Feb 5, 2025· Updated Jun 12, 2025

gzip integer overflow

CVE-2025-0725

Description

Integer overflow in libcurl's gzip decompression when using zlib ≤1.2.0.3 leads to buffer overflow; fixed in curl 8.12.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Integer overflow in libcurl's gzip decompression when using zlib ≤1.2.0.3 leads to buffer overflow; fixed in curl 8.12.0.

Vulnerability

When libcurl is configured to perform automatic gzip decompression of HTTP responses via CURLOPT_ACCEPT_ENCODING, and the runtime zlib version is 1.2.0.3 or older, an integer overflow in the decompression logic can cause a buffer overflow. This code path is only taken for these ancient zlib versions. Affected curl versions: 7.10.5 through 8.11.1 inclusive. Versions before 7.10.5 and after 8.12.0 are not affected [1].

Exploitation

An attacker must control an HTTP response that includes gzip content-encoding and craft the compressed data to trigger the integer overflow. No authentication is required; the attack can be performed by a malicious server or via a man-in-the-middle position. The overflow occurs during the decompression of the response body [1].

Impact

Successful exploitation results in a buffer overflow, potentially leading to memory corruption and arbitrary code execution. However, the severity is rated Low because the vulnerable code path is only reachable when using a zlib version older than 1.2.0.4 (released in 2003), which itself has numerous other security issues [1].

Mitigation

The vulnerability is fixed in curl 8.12.0, which removes support for zlib versions older than 1.2.0.4. Users should upgrade to curl 8.12.0 or later. If upgrading is not immediately possible, ensure that the system's zlib version is 1.2.0.4 or newer. No other workaround is available [1].

References
  1. curl - gzip integer overflow

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

38

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

3

News mentions

0

No linked articles in our index yet.