CVE-2025-49015

4.9 mediumEPSS 0.2%

Medium (4.9) in couchbase .net sdk. EPSS 0.2% chance of exploitation in the next 30 days.

The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.

Severity

CVSS 3.1

4.9 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-31)
CWE: CWE-297
Published: 2025-06-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

couchbase:.net_sdk

References

https://docs.couchbase.com/server/current/release-notes/relnotes.html
https://forums.couchbase.com/tags/security
https://www.couchbase.com/alerts/

Check your stack JSON