{"id":"CVE-2025-4947","aliases":["ALPINE-CVE-2025-4947","AZL-62055","BELL-CVE-2025-4947","CURL-CVE-2025-4947","DEBIAN-CVE-2025-4947","EUVD-2025-16303","GHSA-ppfq-jg49-mqj4","JLSEC-2026-432","SUSE-SU-2025:03198-1","SUSE-SU-2025:20675-1","openSUSE-SU-2025:15176-1"],"status":"published","title":"QUIC certificate check skip with wolfSSL","description":"libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.003,"percentile":0.22892,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2025-05-28T06:29:34Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["8.14.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["8.14.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["8.14.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["8.14.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.14.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.14.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cmake","fixed_in":["3.30.3-7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["8.14.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.14.0-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.14.1+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.14.1+0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.8.0"},{"fixed":"8.14.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.8.0"},{"fixed":"8.14.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.8.0"},{"fixed":"8.14.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.8.0"},{"fixed":"8.14.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.8.0"},{"fixed":"8.14.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.8.0"},{"fixed":"8.14.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.3-7"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.0-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.9.0+0"},{"fixed":"8.14.1+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.8.0+0"},{"fixed":"8.14.1+0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.28.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.28.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.28.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-slfo.1.1_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.0-1.1"}]}],"bundled":2}],"products":[{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"curl"}],"references":[{"url":"https://curl.se/docs/CVE-2025-4947.json","tags":["Vendor Advisory","web"]},{"url":"https://curl.se/docs/CVE-2025-4947.html","tags":["Patch","Vendor Advisory","web"]},{"url":"https://hackerone.com/reports/3150884","tags":["Exploit","Issue Tracking","Patch","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/05/28/4","tags":["Mailing List","Patch","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4947","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-ppfq-jg49-mqj4","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-4947","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-4947","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4947.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-4947","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503198-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228260","tags":["report"]},{"url":"https://bugzilla.suse.com/1236589","tags":["report"]},{"url":"https://bugzilla.suse.com/1243397","tags":["report"]},{"url":"https://bugzilla.suse.com/1243706","tags":["report"]},{"url":"https://bugzilla.suse.com/1243933","tags":["report"]},{"url":"https://bugzilla.suse.com/1246197","tags":["report"]},{"url":"https://bugzilla.suse.com/1249191","tags":["report"]},{"url":"https://bugzilla.suse.com/1249348","tags":["report"]},{"url":"https://bugzilla.suse.com/1249367","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9086","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520675-1/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EUPBCSZS5WF7PEW254KIANGQR6ICP23C/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-4947","title":"QUIC certificate check skip with wolfSSL","description":"libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.","status":"published","published":"2025-05-28T06:29:34.974Z","modified":"2025-05-28T13:58:33.43Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:32:48.512547Z"}],"euvd":[{"id":"EUVD-2025-16303","description":"libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.","status":"published","published":"2025-05-28T06:29:34Z","modified":"2025-05-28T13:58:33Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:37.456975Z"}],"ghsa":[{"id":"GHSA-ppfq-jg49-mqj4","title":"libcurl accidentally skips the certificate verification for QUIC connections when connecting to a...","description":"libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.","status":"published","published":"2025-05-28T09:31:26Z","modified":"2025-06-26T18:31:19Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:02:48.872885Z"}],"nvd":[{"id":"CVE-2025-4947","description":"libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.","status":"published","published":"2025-05-28T07:15:24.78Z","modified":"2026-06-17T09:34:22.287Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:11:10.143444Z"}],"osv":[{"id":"ALPINE-CVE-2025-4947","description":"libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.","status":"published","published":"2025-05-28T07:15:24.78Z","modified":"2026-08-27T22:18:02.987265816Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2025-4947","title":"CVE-2025-4947 does not affect BellSoft software","status":"withdrawn","published":"2025-05-29T06:45:23.836706Z","modified":"2026-08-31T07:15:05.991555838Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-4947","title":"QUIC certificate check skip with wolfSSL","description":"libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.","status":"published","published":"2025-05-28T06:29:34.974Z","modified":"2026-10-28T02:31:01.159704166Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"DEBIAN-CVE-2025-4947","description":"libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.","status":"published","published":"2025-05-28T07:15:24.78Z","modified":"2026-09-01T20:05:53.365498302Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"JLSEC-2026-432","title":"libcurl accidentally skips the certificate verification for QUIC connections when connecting to a...","description":"libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.","status":"published","published":"2026-05-04T13:12:06.605Z","modified":"2026-07-18T00:01:59.676656283Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"AZL-62055","title":"CVE-2025-4947 affecting package cmake for versions less than 3.30.3-7","description":"libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.","status":"published","published":"2025-05-28T07:15:24Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"CURL-CVE-2025-4947","title":"QUIC certificate check skip with wolfSSL","description":"libcurl accidentally skips the certificate verification for QUIC connections\nwhen connecting to a host specified as an IP address in the URL. Therefore, it\ndoes not detect impostors or man-in-the-middle attacks.","status":"published","published":"2025-05-28T08:00:00Z","modified":"2026-10-25T01:05:40.942983026Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"openSUSE-SU-2025:15176-1","title":"curl-8.14.0-1.1 on GA media","description":"These are all security issues fixed in the curl-8.14.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-30T00:00:00Z","modified":"2026-03-23T04:53:27.253146Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2025:03198-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nUpdate to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).    \n    \nSecurity issues fixed:\n\n- CVE-2025-0665: eventfd double close can cause libcurl to act unreliably (bsc#1236589).\n- CVE-2025-4947: QUIC certificate check is skipped with wolfSSL allows for MITM attacks (bsc#1243397).\n- CVE-2025-5025: no QUIC certificate pinning with wolfSSL can lead to connections to impostor servers that are not\n  easily noticed (bsc#1243706).\n- CVE-2025-5399: bug in websocket code can cause libcurl to get trapped in an endless busy-loop when processing\n  specially crafted packets (bsc#1243933).\n- CVE-2024-6874: punycode conversions to/from IDN can leak stack content when libcurl is built to use the macidn IDN\n  backend (bsc#1228260).\n- CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer\n  (bsc#1249191).\n- CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).\n\nOther issues fixed:\n    \n- Fix wrong return code when --retry is used (bsc#1249367).\n  * tool_operate: fix return code when --retry is used but not triggered [b42776b]\n    \n- Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).\n  * tool_getparam: fix --ftp-pasv [5f805ee]\n\n- Fixed with version 8.14.1:\n  * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.\n  * websocket: add option to disable auto-pong reply.\n  * huge number of bugfixes.\n\n  Please see https://curl.se/ch/ for full changelogs.\n","status":"published","published":"2025-09-12T12:15:10Z","modified":"2026-03-23T04:50:28.709496Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:20675-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2025-5399: libcurl can possibly get trapped in an endless busy-loop when processing specially crafted packets (bsc#1243933).\n- CVE-2025-5025: No QUIC certificate pinning with wolfSSL (bsc#1243706).\n- CVE-2025-4947: QUIC certificate check skip with wolfSSL (bsc#1243397).\n\nOther bugfixes:\n\n- Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).\n","status":"published","published":"2025-09-09T10:21:16Z","modified":"2026-03-23T04:47:18.016584Z","updated_at":"2026-11-02T15:53:59.92114Z"}]}}