---
id: "CVE-2025-49015"
kind: "vulnerability"
aliases: ["CVE-2025-49015", "GHSA-px2c-r924-mwcc"]
title: "Couchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates"
severity: "medium"
cvss: 4.900000095367432
epss: 0.002300000051036477
exploited: false
status: "open"
category: "package"
products: [{"name": "CouchbaseNetClient", "fixed": ["3.7.1"], "affected": "< 3.7.1", "ecosystem": "nuget"}, {"name": "couchbase .net sdk", "fixed": [], "affected": "<= 3.7.1", "ecosystem": "vendor"}]
ecosystems: ["nuget", "vendor"]
tags: ["couchbase", "cwe-297", "dotnet", "nuget", "package"]
not_affected_if: ["no-tls-to-couchbase", "version-3.7.1-or-later"]
published_at: "2025-06-18T14:15:44+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-px2c-r924-mwcc", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49015", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# Couchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates

The Couchbase .NET SDK before 3.7.1 does not verify that the server's TLS certificate matches the hostname it connects to. A network attacker positioned between the app and the database can impersonate the server and intercept or alter traffic.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- nuget:CouchbaseNetClient affected < 3.7.1 fixed 3.7.1
- vendor:couchbase .net sdk affected <= 3.7.1 fixed ?

## How to check

Check the CouchbaseNetClient version in the .csproj or packages.config (for example, dotnet list package | grep -i couchbase).

## Fix

Upgrade the CouchbaseNetClient NuGet package to 3.7.1 or later.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-px2c-r924-mwcc
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-49015

## From the sources

The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_