CVE-2025-5025

curl: libcurl: QUIC Certificate Pinning Bypass

Loading…

Severity

Moderate

Red Hat Product Security

4.8

CVSS 3.1

Review impact separately from score.

Published · May 28, 2025

Updated · August 31, 2026

Description

A flaw was found in libcurl. This vulnerability can allow an attacker to connect to an imposter server via HTTP/3 QUIC connections when using the wolfSSL TLS backend, bypassing certificate pinning verification.

This issue only affects instances of curl and libcurl using WolfSSL as the backend TLS library.

Statement

This vulnerability doesn't impact any Red Hat supported curl versions, as Red Hat doesn't ship the WolfSSL TLS library in any product.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 4.8
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-295 · Improper Certificate Validation