{"id":"CVE-2025-5025","aliases":["ALPINE-CVE-2025-5025","AZL-62038","BELL-CVE-2025-5025","CURL-CVE-2025-5025","DEBIAN-CVE-2025-5025","EUVD-2025-16332","GHSA-x8ch-h5vv-q6cm","JLSEC-2026-433","SUSE-SU-2025:03198-1","SUSE-SU-2025:20675-1","openSUSE-SU-2025:15176-1"],"status":"published","title":"No QUIC certificate pinning with wolfSSL","description":"libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00306,"percentile":0.23599,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-295"],"published":"2025-05-28T06:29:51Z","modified":"2026-11-05T05:40:51Z","exploits":[{"source":"pocgithub","id":"KiPhuong/cve-2025-5025","title":"KiPhuong/cve-2025-5025","date":"2025-07-22","url":"https://github.com/KiPhuong/cve-2025-5025"}],"fixes":[{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["8.14.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["8.14.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["8.14.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["8.14.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.14.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.14.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cmake","fixed_in":["3.30.3-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["8.14.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.14.0-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.14.1+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.14.1+0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.14.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.14.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.14.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.14.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.14.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.14.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.3-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.0-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.5.0+0"},{"fixed":"8.14.1+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.5.0+0"},{"fixed":"8.14.1+0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.28.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.28.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.28.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-slfo.1.1_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.0-1.1"}]}],"bundled":2}],"products":[{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"curl"}],"references":[{"url":"https://curl.se/docs/CVE-2025-5025.json","tags":["Vendor Advisory","web"]},{"url":"https://curl.se/docs/CVE-2025-5025.html","tags":["Vendor Advisory","web"]},{"url":"https://hackerone.com/reports/3153497","tags":["Exploit","Issue Tracking","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/05/28/5","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5025","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-x8ch-h5vv-q6cm","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-5025","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-5025","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5025.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-5025","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503198-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228260","tags":["report"]},{"url":"https://bugzilla.suse.com/1236589","tags":["report"]},{"url":"https://bugzilla.suse.com/1243397","tags":["report"]},{"url":"https://bugzilla.suse.com/1243706","tags":["report"]},{"url":"https://bugzilla.suse.com/1243933","tags":["report"]},{"url":"https://bugzilla.suse.com/1246197","tags":["report"]},{"url":"https://bugzilla.suse.com/1249191","tags":["report"]},{"url":"https://bugzilla.suse.com/1249348","tags":["report"]},{"url":"https://bugzilla.suse.com/1249367","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9086","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520675-1/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EUPBCSZS5WF7PEW254KIANGQR6ICP23C/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-5025","title":"No QUIC certificate pinning with wolfSSL","description":"libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.","status":"published","published":"2025-05-28T06:29:51.915Z","modified":"2025-05-30T16:19:53.775Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:32:29.97618Z"}],"euvd":[{"id":"EUVD-2025-16332","description":"libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.","status":"published","published":"2025-05-28T06:29:51Z","modified":"2025-05-30T16:19:53Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:34.145186Z"}],"ghsa":[{"id":"GHSA-x8ch-h5vv-q6cm","title":"libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an...","description":"libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.","status":"published","published":"2025-05-28T09:31:26Z","modified":"2025-07-30T21:32:41Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:03:09.000825Z"}],"nvd":[{"id":"CVE-2025-5025","description":"libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.","status":"published","published":"2025-05-28T07:15:24.91Z","modified":"2026-06-17T09:47:03.12Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:11:10.143444Z"}],"osv":[{"id":"ALPINE-CVE-2025-5025","description":"libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.","status":"published","published":"2025-05-28T07:15:24.91Z","modified":"2026-08-27T22:18:02.989241473Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2025-5025","title":"CVE-2025-5025 does not affect BellSoft software","status":"withdrawn","published":"2025-05-29T06:45:04.27105Z","modified":"2026-08-31T07:15:06.024147116Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-5025","title":"No QUIC certificate pinning with wolfSSL","description":"libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.","status":"published","published":"2025-05-28T06:29:51.915Z","modified":"2026-10-28T02:30:23.485912084Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"DEBIAN-CVE-2025-5025","description":"libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.","status":"published","published":"2025-05-28T07:15:24.91Z","modified":"2026-09-01T20:05:53.501891199Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"JLSEC-2026-433","title":"libcurl supports *pinning* of the server certificate public key for HTTPS transfers","description":"libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.","status":"published","published":"2026-05-04T13:12:06.605Z","modified":"2026-07-25T18:24:26.030707372Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"AZL-62038","title":"CVE-2025-5025 affecting package cmake for versions less than 3.30.3-6","description":"libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.","status":"published","published":"2025-05-28T07:15:24Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"CURL-CVE-2025-5025","title":"No QUIC certificate pinning with wolfSSL","description":"libcurl supports *pinning* of the server certificate public key for HTTPS\ntransfers. Due to an omission, this check is not performed when connecting\nwith QUIC for HTTP/3, when the TLS backend is wolfSSL.\n\nDocumentation says the option works with wolfSSL, failing to specify that it\ndoes not for QUIC and HTTP/3.\n\nSince pinning makes the transfer succeed if the pin is fine, users could\nunwittingly connect to an impostor server without noticing.","status":"published","published":"2025-05-28T08:00:00Z","modified":"2026-10-25T01:05:41.732094067Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"openSUSE-SU-2025:15176-1","title":"curl-8.14.0-1.1 on GA media","description":"These are all security issues fixed in the curl-8.14.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-30T00:00:00Z","modified":"2026-03-23T04:53:27.253146Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2025:03198-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nUpdate to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).    \n    \nSecurity issues fixed:\n\n- CVE-2025-0665: eventfd double close can cause libcurl to act unreliably (bsc#1236589).\n- CVE-2025-4947: QUIC certificate check is skipped with wolfSSL allows for MITM attacks (bsc#1243397).\n- CVE-2025-5025: no QUIC certificate pinning with wolfSSL can lead to connections to impostor servers that are not\n  easily noticed (bsc#1243706).\n- CVE-2025-5399: bug in websocket code can cause libcurl to get trapped in an endless busy-loop when processing\n  specially crafted packets (bsc#1243933).\n- CVE-2024-6874: punycode conversions to/from IDN can leak stack content when libcurl is built to use the macidn IDN\n  backend (bsc#1228260).\n- CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer\n  (bsc#1249191).\n- CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).\n\nOther issues fixed:\n    \n- Fix wrong return code when --retry is used (bsc#1249367).\n  * tool_operate: fix return code when --retry is used but not triggered [b42776b]\n    \n- Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).\n  * tool_getparam: fix --ftp-pasv [5f805ee]\n\n- Fixed with version 8.14.1:\n  * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.\n  * websocket: add option to disable auto-pong reply.\n  * huge number of bugfixes.\n\n  Please see https://curl.se/ch/ for full changelogs.\n","status":"published","published":"2025-09-12T12:15:10Z","modified":"2026-03-23T04:50:28.709496Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:20675-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2025-5399: libcurl can possibly get trapped in an endless busy-loop when processing specially crafted packets (bsc#1243933).\n- CVE-2025-5025: No QUIC certificate pinning with wolfSSL (bsc#1243706).\n- CVE-2025-4947: QUIC certificate check skip with wolfSSL (bsc#1243397).\n\nOther bugfixes:\n\n- Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).\n","status":"published","published":"2025-09-09T10:21:16Z","modified":"2026-03-23T04:47:18.016584Z","updated_at":"2026-11-02T15:53:59.92114Z"}]}}