All vulnerabilities
CVE-2025-49015GHSA-px2c-r924-mwcc

CouchbaseNetClient: Couchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates

n/a CouchbaseNetClientnugetLibraries & packages
Open in ThreatlineRecord JSON
CVSS
4.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.7.1Fixed versionGitHub
Published18 Jun 2025Updated 19 Oct 2026CVE List

What fixes it

  • 3.7.1CouchbaseNetClient, nugetGitHubdotnet add package CouchbaseNetClient --version 3.7.1
  • 3.7.1CouchbaseNetClient, NuGetOSVdotnet add package CouchbaseNetClient --version 3.7.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.

Text from CVE List

Affected versions 53

  • CouchbaseNetClient, nuget< 3.7.1GitHub
  • n/aaffected: n/aCVE List
  • CouchbaseNetClient, NuGetfrom first release, fixed in 3.7.1OSV
  • CouchbaseNetClient, NuGet0.9.0OSV
  • CouchbaseNetClient, NuGet0.9.1OSV
  • CouchbaseNetClient, NuGet0.9.2OSV
  • CouchbaseNetClient, NuGet1.0.0OSV
  • CouchbaseNetClient, NuGet1.0.1OSV
  • CouchbaseNetClient, NuGet1.1.0OSV
  • CouchbaseNetClient, NuGet1.1.0.1OSV
  • CouchbaseNetClient, NuGet1.1.1OSV
  • CouchbaseNetClient, NuGet1.1.2OSV
  • CouchbaseNetClient, NuGet1.1.3OSV
  • CouchbaseNetClient, NuGet1.1.4OSV
  • CouchbaseNetClient, NuGet1.1.5OSV
  • CouchbaseNetClient, NuGet1.1.6OSV
  • CouchbaseNetClient, NuGet1.2.0OSV
  • CouchbaseNetClient, NuGet1.2.0-betaOSV
  • CouchbaseNetClient, NuGet1.2.0-beta-2OSV
  • CouchbaseNetClient, NuGet1.2.0-beta-3OSV
  • CouchbaseNetClient, NuGet1.2.1OSV
  • CouchbaseNetClient, NuGet1.2.2OSV
  • CouchbaseNetClient, NuGet1.2.2.1OSV
  • CouchbaseNetClient, NuGet1.2.3OSV
  • CouchbaseNetClient, NuGet1.2.4OSV
  • CouchbaseNetClient, NuGet1.2.5OSV
  • CouchbaseNetClient, NuGet1.2.6OSV
  • CouchbaseNetClient, NuGet1.2.7OSV
  • CouchbaseNetClient, NuGet1.2.8OSV
  • CouchbaseNetClient, NuGet1.2.9OSV
  • CouchbaseNetClient, NuGet1.3.0OSV
  • CouchbaseNetClient, NuGet1.3.1OSV
  • CouchbaseNetClient, NuGet1.3.10OSV
  • CouchbaseNetClient, NuGet1.3.11OSV
  • CouchbaseNetClient, NuGet1.3.12OSV
  • CouchbaseNetClient, NuGet1.3.13OSV
  • CouchbaseNetClient, NuGet1.3.2OSV
  • CouchbaseNetClient, NuGet1.3.3OSV
  • CouchbaseNetClient, NuGet1.3.4OSV
  • CouchbaseNetClient, NuGet1.3.5OSV
  • CouchbaseNetClient, NuGet1.3.6OSV
  • CouchbaseNetClient, NuGet1.3.7OSV
  • CouchbaseNetClient, NuGet1.3.8OSV
  • CouchbaseNetClient, NuGet1.3.9OSV
  • CouchbaseNetClient, NuGet2.0.0OSV
  • CouchbaseNetClient, NuGet2.0.0-betaOSV
  • CouchbaseNetClient, NuGet2.0.0-beta2OSV
  • CouchbaseNetClient, NuGet2.0.0.1OSV
  • CouchbaseNetClient, NuGet2.0.1OSV
  • CouchbaseNetClient, NuGet2.0.2OSV
  • CouchbaseNetClient, NuGet2.0.3OSV
  • CouchbaseNetClient, NuGet2.0.3.1OSV
  • CouchbaseNetClient, NuGet2.0.3.2OSV

References 7