Is the latest curl vulnerability "Curl < 8.12.0 Double Close (CVE-2025-0665)" fixed in the Feb 2025 patches?

Question

Is the latest curl vulnerability "Curl < 8.12.0 Double Close (CVE-2025-0665)" fixed in the Feb 2025 patches?

Sinsi P A 25

Our Windows servers has been notified with the curl vulnerability "Curl < 8.12.0 Double Close (CVE-2025-0665)". We have applied the Feb month OS patches already. But it did not fix the vuln. Is MS planning to release the fix soon in their next releases?

Joshua Huang 20 Reputation points

2025-03-27T08:12:41.84+00:00

would like to check where i should keep track of Haxx Curl 8.12.0 being released for microsoft windows server?
Gabriel de Favari Snikuer 0 Reputation points

2025-04-22T12:51:22.8233333+00:00

@Anonymous I have the same question. Can you confirm when Microsoft plans to release CURL 8.12.0 for Microsoft Windows Server? Is there any page where we can track this?
Joe Moorcroft 5 Reputation points

2025-04-22T13:26:05.6866667+00:00

I would also like to know Microsofts patch plan to fix or patch the curl.exe application. I can't find anything relating to an announced update
Mohanraj Elango 0 Reputation points

2025-04-24T05:26:44.65+00:00

Hi Team,

Do we have any work around to fix this vulnerability?

2 answers

Your answer

Joshua Huang 20 Reputation points

2025-03-27T08:12:41.84+00:00

would like to check where i should keep track of Haxx Curl 8.12.0 being released for microsoft windows server?
Gabriel de Favari Snikuer 0 Reputation points

2025-04-22T12:51:22.8233333+00:00

@Anonymous I have the same question. Can you confirm when Microsoft plans to release CURL 8.12.0 for Microsoft Windows Server? Is there any page where we can track this?
Joe Moorcroft 5 Reputation points

2025-04-22T13:26:05.6866667+00:00

I would also like to know Microsofts patch plan to fix or patch the curl.exe application. I can't find anything relating to an announced update
Mohanraj Elango 0 Reputation points

2025-04-24T05:26:44.65+00:00

Hi Team,

Do we have any work around to fix this vulnerability?

Answer 1

Anonymous

Hello,

Thank you for posting in Microsoft Q&A.

Based on the description, I understand your question is related to vulnerability.

There is no Microsoft official announcement yet, try keep an eye on upcoming patch notes and security advisories from Microsoft for any updates regarding this issue.

To mitigate this vulnerability, you can take one of the following actions:

Upgrade curl and libcurl to version 8.12.0 or later.

Apply the patch to your current version and rebuild.

Disable eventfd use in your build.

Use the c-ares resolver backend

Have a nice day.

Best Regards,

Molly

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it

Sinsi P A 25 Reputation points

2025-03-17T04:50:58.2333333+00:00

Curl is an inbuilt component in the windows built right. Previously any curl upgrade was released through MS monthly patches for windows. So just wondering if there is any plans to release the same this time as well.
Anonymous

2025-03-20T08:17:45.26+00:00

There is no Microsoft official announcement yet, try keep an eye on upcoming patch notes and security advisories from Microsoft for any updates regarding this issue.
L K 0 Reputation points

2025-04-21T14:37:19.4266667+00:00

Any more information from Microsoft on updating Curl to v8.12 or newer?
Harshit Tyagi 0 Reputation points

2025-04-30T10:11:11.69+00:00

Hello @Molly Lu-MSFT , As per https://curl.se/docs/vuln-8.12.0.html , Latest version curl was released on 5th Feb 2025 , Do you have any update on upcoming patch in May since it is not available in April patch

Answer 2

Harshit Tyagi 0

Hello @Anonymous , As per https://curl.se/docs/vuln-8.12.0.html , Latest version curl was released on 5th Feb 2025 , Do you have any update on upcoming patch in May since it is not available in April patch

Mat Fudge 0 Reputation points

2025-05-08T15:32:46.9433333+00:00

Come on MS. This is a joke. Get this sh** patched.

Share via

Is the latest curl vulnerability "Curl < 8.12.0 Double Close (CVE-2025-0665)" fixed in the Feb 2025 patches?

2 answers

Your answer