Every CVE Search/ Get API key

CVE-2025-5025

No QUIC certificate pinning with wolfSSL

4.8 MediumPublic exploitFix available

libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.31%Up 0.3 points since May 28, 2025
90%50%10%1%

What each source reports

CVE List Score used 4.8

No QUIC certificate pinning with wolfSSL

libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.

Record
CVE-2025-5025
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
EUVDEUVD-2025-16332 4.8

libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.

Record
EUVD-2025-16332
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-x8ch-h5vv-q6cm 4.8

libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an...

libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.

Record
GHSA-x8ch-h5vv-q6cm
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-295
Updated
2026-11-02
NVD 4.8

libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.

Record
CVE-2025-5025
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-295
Updated
2026-11-02
OSVALPINE-CVE-2025-5025 4.8

libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.

Record
ALPINE-CVE-2025-5025
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVBELL-CVE-2025-5025 4.8

CVE-2025-5025 does not affect BellSoft software

Record
BELL-CVE-2025-5025
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
Show 8 moreShow less
OSV 4.8

No QUIC certificate pinning with wolfSSL

libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.

Record
CVE-2025-5025
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2025-5025 4.8

libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.

Record
DEBIAN-CVE-2025-5025
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVJLSEC-2026-433 4.8

libcurl supports *pinning* of the server certificate public key for HTTPS transfers

libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.

Record
JLSEC-2026-433
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVAZL-62038 No score

CVE-2025-5025 affecting package cmake for versions less than 3.30.3-6

libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.

Record
AZL-62038
Updated
2026-11-05
OSVCURL-CVE-2025-5025 No score

No QUIC certificate pinning with wolfSSL

libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL.

Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3.

Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.

Record
CURL-CVE-2025-5025
Updated
2026-11-02
OSVopenSUSE-SU-2025:15176-1 No score

curl-8.14.0-1.1 on GA media

These are all security issues fixed in the curl-8.14.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15176-1
Updated
2026-11-02
OSVSUSE-SU-2025:03198-1 No score

Security update for curl

This update for curl fixes the following issues:

Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).

Security issues fixed:

  • CVE-2025-0665: eventfd double close can cause libcurl to act unreliably (bsc#1236589).
  • CVE-2025-4947: QUIC certificate check is skipped with wolfSSL allows for MITM attacks (bsc#1243397).
  • CVE-2025-5025: no QUIC certificate pinning with wolfSSL can lead to connections to impostor servers that are not easily noticed (bsc#1243706).
  • CVE-2025-5399: bug in websocket code can cause libcurl to get trapped in an endless busy-loop when processing specially crafted packets (bsc#1243933).
  • CVE-2024-6874: punycode conversions to/from IDN can leak stack content when libcurl is built to use the macidn IDN backend (bsc#1228260).
  • CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer (bsc#1249191).
  • CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).

Other issues fixed:

  • Fix wrong return code when --retry is used (bsc#1249367).

    • tool_operate: fix return code when --retry is used but not triggered [b42776b]

  • Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).

    • tool_getparam: fix --ftp-pasv [5f805ee]

  • Fixed with version 8.14.1:

    • TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.
    • websocket: add option to disable auto-pong reply.
    • huge number of bugfixes.

    Please see https://curl.se/ch/ for full changelogs.

Record
SUSE-SU-2025:03198-1
Updated
2026-11-02
OSVSUSE-SU-2025:20675-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2025-5399: libcurl can possibly get trapped in an endless busy-loop when processing specially crafted packets (bsc#1243933).
  • CVE-2025-5025: No QUIC certificate pinning with wolfSSL (bsc#1243706).
  • CVE-2025-4947: QUIC certificate check skip with wolfSSL (bsc#1243397).

Other bugfixes:

  • Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).
Record
SUSE-SU-2025:20675-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
curl
Alpine:v3.19
 8.5.0 up to 8.14.0-r0
8.14.0-r0
curl
Alpine:v3.20
 8.5.0 up to 8.14.0-r0
8.14.0-r0
curl
Alpine:v3.21
 8.5.0 up to 8.14.0-r0
8.14.0-r0
curl
Alpine:v3.22
 8.5.0 up to 8.14.0-r0
8.14.0-r0
curl
Alpine:v3.23
 8.5.0 up to 8.14.0-r0
8.14.0-r0
curl
Alpine:v3.24
 8.5.0 up to 8.14.0-r0
8.14.0-r0
cmake
Azure Linux:3
 before 3.30.3-6
3.30.3-6
curl
Debian:13
 before 8.14.0-1
8.14.0-1
curl
Debian:14
 before 8.14.0-1
8.14.0-1
CURL_jll
Julia
 8.5.0+0 up to 8.14.1+0
8.14.1+0
Show 6 moreShow less
Affected packages
PackageAffectedFixed
LibCURL_jll
Julia
 8.5.0+0 up to 8.14.1+0
8.14.1+0
curl
SUSE:Linux Enterprise Module for Basesystem 15 SP6
From an advisory covering 7 CVEs
 before 8.14.1-150600.4.28.1
8.14.1-150600.4.28.1
curl
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 7 CVEs
 before 8.14.1-150600.4.28.1
8.14.1-150600.4.28.1
curl
openSUSE:Leap 15.6
From an advisory covering 7 CVEs
 before 8.14.1-150600.4.28.1
8.14.1-150600.4.28.1
curl
SUSE:Linux Micro 6.1
From an advisory covering 3 CVEs
 before 8.14.1-slfo.1.1_1.1
8.14.1-slfo.1.1_1.1
curl
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 8.14.0-1.1
8.14.0-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubKiPhuong/cve-2025-50252025-07-22

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-5025 is a medium vulnerability (CVSS 4.8) in Curl, published May 28, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. Fixed in curl 8.14.0-r0.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open