---
id: CVE-2025-49015
aliases:
  - GHSA-px2c-r924-mwcc
title: >-
  Couchbase .NET SDK (client library) does not properly enable hostname
  verification for TLS certificates
summary: >-
  Couchbase .NET SDK (client library) does not properly enable hostname
  verification for TLS certificates
severity: medium
cvss: 4.9
cwe:
  - CWE-297
vendor: CouchbaseNetClient
product: CouchbaseNetClient
ecosystem: nuget
affected:
  - CouchbaseNetClient < 3.7.1
patched:
  - CouchbaseNetClient 3.7.1
published: '2025-06-18'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T20:55:13Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-px2c-r924-mwcc'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-49015'
  - url: 'https://docs.couchbase.com/server/current/release-notes/relnotes.html'
  - url: 'https://forums.couchbase.com/tags/security'
  - url: 'https://www.couchbase.com/alerts'
  - url: >-
      https://github.com/couchbase/couchbase-net-client/commit/04d1679b2178f922036be6e595b3d91f972c5ba3
  - url: 'https://github.com/advisories/GHSA-px2c-r924-mwcc'
tags:
  - ghsa
  - nuget
epss: 0.0023
epssPercentile: 0.13692
ingestedAt: '2026-10-19T21:43:56.108Z'
---

## Overview

The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.

## Affected packages

- `CouchbaseNetClient < 3.7.1`

## Remediation

Upgrade to a patched release:

- `CouchbaseNetClient 3.7.1`