Live › vulnerability › CVE-2025-49015
Go to dashboardThe Couchbase .NET SDK before 3.7.1 does not verify that the server's TLS certificate matches the hostname it connects to. A network attacker positioned between the app and the database can impersonate the server and intercept or alter traffic.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| CouchbaseNetClient | nuget | < 3.7.1 | 3.7.1 |
| couchbase .net sdk | vendor | <= 3.7.1 | – |
Check the CouchbaseNetClient version in the .csproj or packages.config (for example, dotnet list package | grep -i couchbase).
Upgrade the CouchbaseNetClient NuGet package to 3.7.1 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.
This page as .md · .json · in your agent: get_signal("CVE-2025-49015")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.