Every CVE Search/ Get API key

CVE-2025-4947

QUIC certificate check skip with wolfSSL

6.5 MediumFix available

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.30%Up 0.3 points since May 28, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.5

QUIC certificate check skip with wolfSSL

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

Record
CVE-2025-4947
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
EUVDEUVD-2025-16303 6.5

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

Record
EUVD-2025-16303
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-ppfq-jg49-mqj4 6.5

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a...

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

Record
GHSA-ppfq-jg49-mqj4
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-295
Updated
2026-11-02
NVD 6.5

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

Record
CVE-2025-4947
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-295
Updated
2026-11-02
OSVALPINE-CVE-2025-4947 6.5

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

Record
ALPINE-CVE-2025-4947
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVBELL-CVE-2025-4947 6.5

CVE-2025-4947 does not affect BellSoft software

Record
BELL-CVE-2025-4947
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
Show 8 moreShow less
OSV 6.5

QUIC certificate check skip with wolfSSL

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

Record
CVE-2025-4947
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2025-4947 6.5

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

Record
DEBIAN-CVE-2025-4947
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVJLSEC-2026-432 6.5

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a...

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

Record
JLSEC-2026-432
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVAZL-62055 No score

CVE-2025-4947 affecting package cmake for versions less than 3.30.3-7

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

Record
AZL-62055
Updated
2026-11-05
OSVCURL-CVE-2025-4947 No score

QUIC certificate check skip with wolfSSL

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

Record
CURL-CVE-2025-4947
Updated
2026-11-02
OSVopenSUSE-SU-2025:15176-1 No score

curl-8.14.0-1.1 on GA media

These are all security issues fixed in the curl-8.14.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15176-1
Updated
2026-11-02
OSVSUSE-SU-2025:03198-1 No score

Security update for curl

This update for curl fixes the following issues:

Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).

Security issues fixed:

  • CVE-2025-0665: eventfd double close can cause libcurl to act unreliably (bsc#1236589).
  • CVE-2025-4947: QUIC certificate check is skipped with wolfSSL allows for MITM attacks (bsc#1243397).
  • CVE-2025-5025: no QUIC certificate pinning with wolfSSL can lead to connections to impostor servers that are not easily noticed (bsc#1243706).
  • CVE-2025-5399: bug in websocket code can cause libcurl to get trapped in an endless busy-loop when processing specially crafted packets (bsc#1243933).
  • CVE-2024-6874: punycode conversions to/from IDN can leak stack content when libcurl is built to use the macidn IDN backend (bsc#1228260).
  • CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer (bsc#1249191).
  • CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).

Other issues fixed:

  • Fix wrong return code when --retry is used (bsc#1249367).

    • tool_operate: fix return code when --retry is used but not triggered [b42776b]

  • Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).

    • tool_getparam: fix --ftp-pasv [5f805ee]

  • Fixed with version 8.14.1:

    • TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.
    • websocket: add option to disable auto-pong reply.
    • huge number of bugfixes.

    Please see https://curl.se/ch/ for full changelogs.

Record
SUSE-SU-2025:03198-1
Updated
2026-11-02
OSVSUSE-SU-2025:20675-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2025-5399: libcurl can possibly get trapped in an endless busy-loop when processing specially crafted packets (bsc#1243933).
  • CVE-2025-5025: No QUIC certificate pinning with wolfSSL (bsc#1243706).
  • CVE-2025-4947: QUIC certificate check skip with wolfSSL (bsc#1243397).

Other bugfixes:

  • Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).
Record
SUSE-SU-2025:20675-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
curl
Alpine:v3.19
 8.8.0 up to 8.14.0-r0
8.14.0-r0
curl
Alpine:v3.20
 8.8.0 up to 8.14.0-r0
8.14.0-r0
curl
Alpine:v3.21
 8.8.0 up to 8.14.0-r0
8.14.0-r0
curl
Alpine:v3.22
 8.8.0 up to 8.14.0-r0
8.14.0-r0
curl
Alpine:v3.23
 8.8.0 up to 8.14.0-r0
8.14.0-r0
curl
Alpine:v3.24
 8.8.0 up to 8.14.0-r0
8.14.0-r0
cmake
Azure Linux:3
 before 3.30.3-7
3.30.3-7
curl
Debian:13
 before 8.14.0-1
8.14.0-1
curl
Debian:14
 before 8.14.0-1
8.14.0-1
CURL_jll
Julia
 8.9.0+0 up to 8.14.1+0
8.14.1+0
Show 6 moreShow less
Affected packages
PackageAffectedFixed
LibCURL_jll
Julia
 8.8.0+0 up to 8.14.1+0
8.14.1+0
curl
SUSE:Linux Enterprise Module for Basesystem 15 SP6
From an advisory covering 7 CVEs
 before 8.14.1-150600.4.28.1
8.14.1-150600.4.28.1
curl
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 7 CVEs
 before 8.14.1-150600.4.28.1
8.14.1-150600.4.28.1
curl
openSUSE:Leap 15.6
From an advisory covering 7 CVEs
 before 8.14.1-150600.4.28.1
8.14.1-150600.4.28.1
curl
SUSE:Linux Micro 6.1
From an advisory covering 3 CVEs
 before 8.14.1-slfo.1.1_1.1
8.14.1-slfo.1.1_1.1
curl
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 8.14.0-1.1
8.14.0-1.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-4947 is a medium vulnerability (CVSS 6.5) in Curl, published May 28, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in curl 8.14.0-r0.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open