Vulnerability in redocly/redoc docker images v2.4 & v2.5
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 25.9k
- Forks
- 2.4k
- Avg merge
- 13h 10m
- Merged PRs (30d)
- 4
Description
Hi,
Describe the bug
CVE-2025-4947 clearly states that libcurl mistakenly bypasses certificate verification for QUIC connections when a host is specified as an IP address in the URL. It is clear that this system does not detect impostors or man-in-the-middle attacks. (https://curl.se/docs/CVE-2025-4947.html)
The docker image redocly/redoc in version 2.4 uses libcurl version 8.11.1 and is affected by the mentioned vulnerability. It is clear that version 2.5 uses libcurl 8.12.1, which is also affected by the vulnerability.
Expected behavior
Docker image version 2.5 or a new one will be published with an unaffected libcurl library.
Minimal reproducible OpenAPI snippet(if possible)
Screenshots
Additional context
Could you check, and if you can, publish the next version of your Docker image with an unaffected libcurl library?
Thank you!
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the redocly/redoc Docker image build for versions 2.4 and 2.5, then verify the bundled libcurl version against CVE-2025-4947. Done means publishing a Docker image with an unaffected libcurl library and confirming its version.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100