CVE-2025-25305: Home Assistant does not correctly validate SSL for outgoing requests in core and used libs

February 18, 2025

Problem: Potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries.

References

github.com/advisories/GHSA-m3pm-rpgg-5wj6
github.com/home-assistant/core
github.com/home-assistant/core/commit/8c6547f1b64f4a3d9f10090b97383353c9367892
github.com/home-assistant/core/security/advisories/GHSA-m3pm-rpgg-5wj6
nvd.nist.gov/vuln/detail/CVE-2025-25305

Code Behaviors & Features

Detect and mitigate CVE-2025-25305 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →