CVE-2025-13034 Details
Description
When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool, curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper check, thus not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2 built to use GnuTLS and the user had to explicitly disable the standard certificate verification.
A vulnerability exists in curl versions 8.8.0 through 8.17.0 when the CURLOPT_PINNEDPUBLICKEY option is used with libcurl or the --pinnedpubkey option is used with the curl command-line tool. Under these conditions, curl is supposed to verify the public key of the server certificate to ensure the authenticity of the peer. However, this verification was bypassed in specific scenarios, particularly when using QUIC with ngtcp2, GnuTLS as the TLS library, and with standard certificate verification disabled. This oversight could allow an attacker to impersonate a server without being detected. It's important to note that this issue does not arise when connecting over HTTP/1 or HTTP/2, where the pinning check functions correctly.
Users are advised to upgrade curl to version 8.18.0, build curl with a different TLS library, or avoid using HTTP/3.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://curl.se/docs/CVE-2025-13034.html | curl | PatchVendor Advisory |
| https://curl.se/docs/CVE-2025-13034.json | curl | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | CISA-ADP |
| CWE-295 | Improper Certificate Validation | curl |
Affected Products
| Product | Versions |
|---|---|
| haxx curl | >= 8.8.0, < 8.18.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | curl |
| Jun 17, 2026 | CVE Modified | curl |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 20, 2026 | Initial Analysis | [email protected] |
| Jan 8, 2026 | CVE Modified | CISA-ADP |
| Jan 8, 2026 | New CVE Received | curl |