What is CVE-2025-49015?

CVE-2025-49015 is a medium-severity vulnerability in Couchbase .Net Sdk, classified under Improper Validation of Certificate with Host Mismatch. CVSS score: 4.9/10. Published 2025-06-18.

How severe is CVE-2025-49015?

Medium severity. CVSS v3 base score is 4.9 out of 10.

Vulnerability in Couchbase .Net Sdk

CVE-2025-49015

The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.

EPSS: 0.002 (9.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

Affected products

Couchbase .Net_sdk
N/a — versions n/a

Weakness classification (CWE)

CWE-297 — Improper Validation of Certificate with Host Mismatch

References

cve@mitre.org (Issue Tracking)
cve@mitre.org (Release Notes)
cve@mitre.org (Vendor Advisory)

Frequently asked questions

What is CVE-2025-49015?: CVE-2025-49015 is a medium-severity vulnerability in Couchbase .Net Sdk, classified under Improper Validation of Certificate with Host Mismatch. CVSS score: 4.9/10. Published 2025-06-18.
How severe is CVE-2025-49015?: Medium severity. CVSS v3 base score is 4.9 out of 10.