CVE-2025-69412 - KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which might allow spoofing of threat data

Back Back to CVE browser

LOW

KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which might allow spoofing of threat data

Published Dec 31, 2025

3.4

LOW

CVSS 3.1

EPSS 0.22%

Description

KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which might allow spoofing of threat data. NOTE: this Lookup API is not contacted in the messagelib default configuration.

Affected products

Vendor KDE Product Messagelib Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <25.11.90

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

KDE

Messagelib

unaffected

Version	Status	Constraints
0	affected	<25.11.90

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-295

Improper Certificate Validation

References (4)

Link	Providers	Tags
https://developers.google.com/safe-browsing/v4
https://developers.google.com/safe-browsing/v4/lookup-api
https://github.com/KDE/messagelib/commit/01adef0482bb3d5c817433db5208620c84a992b3
https://github.com/KDE/messagelib/compare/v25.11.80...v25.11.90