CVE-2025-5025 Details
Description
libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.
A vulnerability exists in curl and libcurl versions 8.5.0 through 8.13.0, when using wolfSSL as the TLS backend for QUIC connections in HTTP/3. The issue arises because the library fails to validate server certificate public key pinning for HTTPS transfers over QUIC, despite the documentation stating that this feature is supported with wolfSSL. As a result, users may unknowingly connect to fraudulent servers without any warning. This vulnerability does not affect HTTP/1.1 or HTTP/2 transfers with wolfSSL, where certificate pinning functions correctly.
Users can upgrade to curl version 8.14.0 or later, where this vulnerability is fixed. Alternatively, avoid using HTTP/3 or certificate pinning with curl versions that utilize wolfSSL.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 30, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://curl.se/docs/CVE-2025-5025.html | curl | Vendor Advisory |
| https://curl.se/docs/CVE-2025-5025.json | curl | Vendor Advisory |
| https://hackerone.com/reports/3153497 | curl | ExploitIssue TrackingThird Party Advisory |
| http://www.openwall.com/lists/oss-security/2025/05/28/5 | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| haxx curl | >= 8.5.0, < 8.14.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | curl |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2025 | Initial Analysis | [email protected] |
| May 30, 2025 | CVE Modified | CISA-ADP |
| May 28, 2025 | CVE Modified | CVE |
| May 28, 2025 | New CVE Received | curl |