CVE-2025-13034

A flaw was found in curl. When configured to use public key pinning with QUIC connections and GnuTLS, and with standard certificate verification explicitly disabled, curl could bypass the intended public key check. This oversight allows a malicious server to impersonate a legitimate one, potentially leading to unauthorized access or information disclosure due to a failure in verifying the server's identity.

This vulnerability is rated Low for Red Hat products. The flaw in curl occurs only when using CURLOPT_PINNEDPUBLICKEY with QUIC and ngtcp2 built with GnuTLS, and when standard certificate verification is explicitly disabled. This specific combination of features and configuration is uncommon in Red Hat deployments, limiting the overall impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that standard certificate verification is not explicitly disabled when utilizing CURLOPT_PINNEDPUBLICKEY or --pinnedpubkey with curl. This practice prevents the bypass of the pinned public key check, particularly in configurations involving QUIC and ngtcp2 built with GnuTLS. Always verify server certificates through standard means to maintain secure connections.