CVE-2025-5025

No QUIC certificate pinning with wolfSSL

State: Published
Severity: 4.8 Medium
Published: May 28, 2025
Updated: May 30, 2025
Reserved: May 21, 2025

Description

libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.

Scores

CVSS	Score	Vector	Source
3.1	4.8 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
curlcurl	8.13.0 through 8.13.0Affected 8.12.1 through 8.12.1Affected 8.12.0 through 8.12.0Affected 8.11.1 through 8.11.1Affected 8.11.0 through 8.11.0Affected 8.10.1 through 8.10.1Affected 8.10.0 through 8.10.0Affected 8.9.1 through 8.9.1Affected 8.9.0 through 8.9.0Affected 8.8.0 through 8.8.0Affected 8.7.1 through 8.7.1Affected 8.7.0 through 8.7.0Affected 8.6.0 through 8.6.0Affected 8.5.0 through 8.5.0Affected

Product

Versions

curlcurl

8.13.0 through 8.13.0Affected
8.12.1 through 8.12.1Affected
8.12.0 through 8.12.0Affected
8.11.1 through 8.11.1Affected
8.11.0 through 8.11.0Affected
8.10.1 through 8.10.1Affected
8.10.0 through 8.10.0Affected
8.9.1 through 8.9.1Affected
8.9.0 through 8.9.0Affected
8.8.0 through 8.8.0Affected
8.7.1 through 8.7.1Affected
8.7.0 through 8.7.0Affected
8.6.0 through 8.6.0Affected
8.5.0 through 8.5.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.