CVE-2025-14819MediumMicrosoft CVSS 5.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Microsoft advisory for CVE-2025-14819

Published
June 2, 2026
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2025-14819 →

📋 Microsoft's advisory

EchelonGraph does not copy Microsoft's advisory page: its FAQ and remediation text are not shown here. Read the advisory on https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-14819. This page also shows what EchelonGraph holds for CVE-2025-14819, with the description from its CVE record, which the CVE Numbering Authority that assigned the CVE wrote: for a CVE Microsoft assigned, often in the words of Microsoft's own advisory.

🎯 Affected products16

  • azl3 curl 8.11.1-4 on Azure Linux 3.0
  • azl3 curl 8.11.1-5 on Azure Linux 3.0
  • azl3 mysql 8.0.44-2 on Azure Linux 3.0
  • azl3 mysql 8.0.45-1 on Azure Linux 3.0
  • azl3 rust 1.75.0-22 on Azure Linux 3.0
  • azl3 rust 1.75.0-24 on Azure Linux 3.0
  • azl3 rust 1.86.0-10 on Azure Linux 3.0
  • azl3 rust 1.90.0-3 on Azure Linux 3.0
  • azl3 tensorflow 2.16.1-10 on Azure Linux 3.0
  • azl3 tensorflow 2.16.1-9 on Azure Linux 3.0
  • cbl2 curl 8.8.0-7 on CBL Mariner 2.0
  • cbl2 curl 8.8.0-8 on CBL Mariner 2.0
  • cbl2 mysql 8.0.44-2 on CBL Mariner 2.0
  • cbl2 mysql 8.0.45-1 on CBL Mariner 2.0
  • cbl2 rust 1.72.0-11 on CBL Mariner 2.0
  • cbl2 rust 1.72.0-13 on CBL Mariner 2.0

🧭 EchelonGraph on CVE-2025-14819

EchelonGraph score
5.3 MEDIUM
CISA KEV
Not listed
Fix status
A fix is available — apply it.

Description from the CVE record (CVE.org), as published by its numbering authority

When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.

Published by curl, the CVE Numbering Authority that assigned CVE-2025-14819, in its CVE record at CVE.org; reused under the CVE Program's Terms of Use (its licence and MITRE's copyright notice are in our Terms of Service).

🔗 References (1)