VulnerabilityAnalyzed
CVE-2025-49015
The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates.
MEDIUM 4.9EPSS 0.21%
Does this matter?
Lower severity and a low EPSS score (0.21%). Track it; it rarely justifies an emergency change on its own.
Description
The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.
- CVSS 3.1
- 4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.21% probability · 12th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-297
- Affected
- couchbase/.net sdk
- Source
- cve@mitre.org
References
- https://docs.couchbase.com/server/current/release-notes/relnotes.htmlRelease Notes
- https://forums.couchbase.com/tags/securityIssue Tracking
- https://www.couchbase.com/alerts/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.