{"id":"CVE-2025-49015","kind":"vulnerability","aliases":["CVE-2025-49015","GHSA-px2c-r924-mwcc"],"related":[],"title":"Couchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates","description":"The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.","summary":"The Couchbase .NET SDK before 3.7.1 does not verify that the server's TLS certificate matches the hostname it connects to. A network attacker positioned between the app and the database can impersonate the server and intercept or alter traffic.","severity":"medium","cvss":4.900000095367432,"epss":0.002300000051036477,"exploited":false,"exploited_at":null,"products":[{"name":"CouchbaseNetClient","fixed":["3.7.1"],"affected":"< 3.7.1","ecosystem":"nuget"},{"name":"couchbase .net sdk","fixed":[],"affected":"<= 3.7.1","ecosystem":"vendor"}],"ecosystems":["nuget","vendor"],"tags":["couchbase","cwe-297","dotnet","nuget","package"],"not_affected_if":["no-tls-to-couchbase","version-3.7.1-or-later"],"how_to_check":"Check the CouchbaseNetClient version in the .csproj or packages.config (for example, dotnet list package | grep -i couchbase).","fix":"Upgrade the CouchbaseNetClient NuGet package to 3.7.1 or later.","status":"open","published_at":"2025-06-18T14:15:44+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T21:49:04+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:49:04Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the CouchbaseNetClient NuGet package to 3.7.1 or later.\nunknown","reach":"network","impact":"medium","summary":"The Couchbase .NET SDK before 3.7.1 does not verify that the server's TLS certificate matches the hostname it connects to. A network attacker positioned between the app and the database can impersonate the server and intercept or alter traffic.","category":"package","who_cares":["couchbase","dotnet","nuget"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker impersonates database server and reads or alters application traffic","analyst_note":"","how_to_check":"Check the CouchbaseNetClient version in the .csproj or packages.config (for example, dotnet list package | grep -i couchbase).\nunknown","needs_analyst":false,"not_affected_if":["version-3.7.1-or-later","no-tls-to-couchbase"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000462,"input_tokens":2837,"output_tokens":356,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':16A,24A '-297':32B '-49015':17A,25A '3.7.1':41B,83C 'address':101C 'also':98C 'alter':74B 'app':63B 'attack':59B 'certif':14A,50B,92C 'client':4A,80C 'configur':108C 'connect':55B 'couchbas':1A,30B,37B,77C 'couchbase':27A 'couchbasenetclient':26A 'cve':15A,23A 'cwe':31B 'databas':66B 'default':115C 'dotnet':33B 'due':105C 'enabl':9A,87C,113C 'fact':94C 'ghsa':19A 'ghsa-px2c-r924-mwcc':18A 'hostnam':10A,53B,88C,104C 'imperson':68B 'incorrect':112C 'instead':102C 'intercept':72B 'ip':100C 'librari':5A,81C 'match':51B 'mwcc':22A 'net':2A,28A,38B,78C 'network':58B 'nuget':34B 'option':109C 'packag':35B 'posit':60B 'proper':8A,86C 'px2c':20A 'r924':21A 'sdk':3A,29A,39B,79C,96C 'server':47B,70B 'tls':13A,49B,91C 'traffic':75B 'use':99C 'verif':11A,89C 'verifi':44B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-06-18T14:15:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-px2c-r924-mwcc","url":"https://github.com/advisories/GHSA-px2c-r924-mwcc","severity":"medium","published_at":"2025-06-18T15:31:15+00:00","modified_at":"2026-10-19T20:55:13+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-49015","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49015","severity":null,"published_at":"2025-06-18T14:15:44+00:00","modified_at":"2026-06-17T09:30:40+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}