libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2025/05/28/5 | Mailing List Third Party Advisory |
| https://curl.se/docs/CVE-2025-5025.html | Vendor Advisory |
| https://curl.se/docs/CVE-2025-5025.json | Vendor Advisory |
| https://hackerone.com/reports/3153497 | Exploit Issue Tracking Third Party Advisory |
Configurations
History
30 Jul 2025, 19:41
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* | |
| First Time |
Haxx
Haxx curl |
|
| CWE | CWE-295 | |
| References | () https://curl.se/docs/CVE-2025-5025.json - Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2025/05/28/5 - Mailing List, Third Party Advisory | |
| References | () https://curl.se/docs/CVE-2025-5025.html - Vendor Advisory | |
| References | () https://hackerone.com/reports/3153497 - Exploit, Issue Tracking, Third Party Advisory |
28 May 2025, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-28 07:15
Updated : 2025-07-30 19:41
NVD link : CVE-2025-5025
Mitre link : CVE-2025-5025
JSON object : View
Products Affected
haxx
- curl
CWE
CWE-295
Improper Certificate Validation