A AegiFlow
MEDIUMCVSS 4.9EPSS 0.2%

CVE-2025-49015

Couchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates

Published
2025-06-18
Modified
2026-10-19
EPSS percentile
13%
Aliases
GHSA-px2c-r924-mwcc
Sources
github-advisory

Summary

The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.

Affected packages

EcosystemPackageAffected versionsFixed versions
NuGetCouchbaseNetClient—3.7.1

Remediation: Upgrade to 3.7.1 or later.

References

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.