Is the latest curl vulnerability "Curl < 8.12.0 Double Close (CVE-2025-0665)" fixed in the Feb 2025 patches?

Question

Is the latest curl vulnerability "Curl < 8.12.0 Double Close (CVE-2025-0665)" fixed in the Feb 2025 patches?

Sinsi P A 25

Our Windows servers has been notified with the curl vulnerability "Curl < 8.12.0 Double Close (CVE-2025-0665)". We have applied the Feb month OS patches already. But it did not fix the vuln. Is MS planning to release the fix soon in their next releases?

Joshua Huang 20 Reputation points

2025-03-27T08:12:41.84+00:00

would like to check where i should keep track of Haxx Curl 8.12.0 being released for microsoft windows server?
Gabriel de Favari Snikuer 0 Reputation points

2025-04-22T12:51:22.8233333+00:00

@Molly Lu-MSFT I have the same question. Can you confirm when Microsoft plans to release CURL 8.12.0 for Microsoft Windows Server? Is there any page where we can track this?
Joe Moorcroft 5 Reputation points

2025-04-22T13:26:05.6866667+00:00

I would also like to know Microsofts patch plan to fix or patch the curl.exe application. I can't find anything relating to an announced update
Mohanraj Elango 0 Reputation points

2025-04-24T05:26:44.65+00:00

Hi Team,

Do we have any work around to fix this vulnerability?

1 answer

Your answer

Joshua Huang 20 Reputation points

2025-03-27T08:12:41.84+00:00

would like to check where i should keep track of Haxx Curl 8.12.0 being released for microsoft windows server?
Gabriel de Favari Snikuer 0 Reputation points

2025-04-22T12:51:22.8233333+00:00

@Molly Lu-MSFT I have the same question. Can you confirm when Microsoft plans to release CURL 8.12.0 for Microsoft Windows Server? Is there any page where we can track this?
Joe Moorcroft 5 Reputation points

2025-04-22T13:26:05.6866667+00:00

I would also like to know Microsofts patch plan to fix or patch the curl.exe application. I can't find anything relating to an announced update
Mohanraj Elango 0 Reputation points

2025-04-24T05:26:44.65+00:00

Hi Team,

Do we have any work around to fix this vulnerability?

Answer 1

Molly Lu-MSFT 2,586 Microsoft External Staff

Hello,

Thank you for posting in Microsoft Q&A.

Based on the description, I understand your question is related to vulnerability.

There is no Microsoft official announcement yet, try keep an eye on upcoming patch notes and security advisories from Microsoft for any updates regarding this issue.

To mitigate this vulnerability, you can take one of the following actions:

Upgrade curl and libcurl to version 8.12.0 or later.

Apply the patch to your current version and rebuild.

Disable eventfd use in your build.

Use the c-ares resolver backend

Have a nice day.

Best Regards,

Molly

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it

Sinsi P A 25 Reputation points

2025-03-17T04:50:58.2333333+00:00

Curl is an inbuilt component in the windows built right. Previously any curl upgrade was released through MS monthly patches for windows. So just wondering if there is any plans to release the same this time as well.
Molly Lu-MSFT 2,586 Reputation points Microsoft External Staff

2025-03-20T08:17:45.26+00:00

There is no Microsoft official announcement yet, try keep an eye on upcoming patch notes and security advisories from Microsoft for any updates regarding this issue.
L K 0 Reputation points

2025-04-21T14:37:19.4266667+00:00

Any more information from Microsoft on updating Curl to v8.12 or newer?

Share via

Is the latest curl vulnerability "Curl < 8.12.0 Double Close (CVE-2025-0665)" fixed in the Feb 2025 patches?

1 answer

Your answer