CVE-2025-5025

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-5025
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-5025.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-5025
Aliases
Downstream
Related
Published
2025-05-28T06:29:51.915Z
Modified
2026-05-18T05:59:33.317424555Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
No QUIC certificate pinning with wolfSSL
Details

libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5025.json",
    "cna_assigner": "curl",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "last_affected": "8.13.0"
                },
                {
                    "last_affected": "8.12.1"
                },
                {
                    "last_affected": "8.12.0"
                },
                {
                    "last_affected": "8.11.1"
                },
                {
                    "last_affected": "8.11.0"
                },
                {
                    "last_affected": "8.10.1"
                },
                {
                    "last_affected": "8.10.0"
                },
                {
                    "last_affected": "8.9.1"
                },
                {
                    "last_affected": "8.9.0"
                },
                {
                    "last_affected": "8.8.0"
                },
                {
                    "last_affected": "8.7.1"
                },
                {
                    "last_affected": "8.7.0"
                },
                {
                    "last_affected": "8.6.0"
                },
                {
                    "last_affected": "8.5.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/curl/curl

Affected ranges

Type
GIT
Repo
https://github.com/curl/curl
Events
Introduced
7161cb17c01dcff1dc5bf89a18437d9d729f1ecd
Fixed
4dacb79fcdd9364c1083e06f6a011d797a344f47
Database specific 
{
    "extracted_events": [
        {
            "introduced": "8.5.0"
        },
        {
            "fixed": "8.14.0"
        }
    ],
    "source": "CPE_FIELD",
    "cpe": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"
}

Affected versions

Other
curl-8_10_0
curl-8_10_1
curl-8_11_0
curl-8_11_1
curl-8_12_0
curl-8_12_1
curl-8_13_0
curl-8_5_0
curl-8_6_0
curl-8_7_0
curl-8_7_1
curl-8_8_0
curl-8_9_0
curl-8_9_1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-5025.json"