CVE-2025-5025
CVE-2025-5025 · No QUIC certificate pinning with wolfSSL
This page contains facts from public vulnerability sources. Check the original advisory before updating.
libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.
CVSS 4.8 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
curl
- Versions
- ≥ 8.13.0, ≤ 8.13.0: Affected (semver)
- ≥ 8.12.1, ≤ 8.12.1: Affected (semver)
- ≥ 8.12.0, ≤ 8.12.0: Affected (semver)
- ≥ 8.11.1, ≤ 8.11.1: Affected (semver)
- ≥ 8.11.0, ≤ 8.11.0: Affected (semver)
- ≥ 8.10.1, ≤ 8.10.1: Affected (semver)
- ≥ 8.10.0, ≤ 8.10.0: Affected (semver)
- ≥ 8.9.1, ≤ 8.9.1: Affected (semver)
- ≥ 8.9.0, ≤ 8.9.0: Affected (semver)
- ≥ 8.8.0, ≤ 8.8.0: Affected (semver)
- ≥ 8.7.1, ≤ 8.7.1: Affected (semver)
- ≥ 8.7.0, ≤ 8.7.0: Affected (semver)
- ≥ 8.6.0, ≤ 8.6.0: Affected (semver)
- ≥ 8.5.0, ≤ 8.5.0: Affected (semver)
No fix published
curl Debian:13
- Affected ranges
- ECOSYSTEM: < 8.14.0-1
Update to 8.14.0-1
curl Debian:14
- Affected ranges
- ECOSYSTEM: < 8.14.0-1
Update to 8.14.0-1