Critical Certificate Pinning Omission in libcurl for QUIC Connections
Summary
CVE-2025-5025: libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Affects curl across 2 version ranges.
< 8.14.0-r0
>= 7161cb17c01dcff1dc5bf89a18437d9d729f1ecd, < 4dacb79fcdd9364c1083e06f6a011d797a344f47
Fixed in 8.14.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libcurl is a widely used open-source client-side URL transfer library that supports various protocols including HTTP, HTTPS, FTP, and more. It is known for its versatility and is utilized in numerous applications for data transfer over the internet. The library's ability to pin server certificate public keys enhances security by ensuring that clients connect only to trusted servers. However, a recent vulnerability has been identified that affects the QUIC protocol when using the wolfSSL TLS backend, potentially exposing users to man-in-the-middle attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2025-5025, arises from an omission in libcurl's implementation of certificate pinning for QUIC connections when using the wolfSSL backend. Although the documentation suggests that certificate pinning is supported, it fails to clarify that this feature does not function for QUIC and HTTP/3 connections. As a result, users may unknowingly connect to impostor servers if the pinning check is not performed, leading to potential data breaches and security risks.
How To Fix
Minimum fixed version
8.14.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using QUIC for HTTP/3 connections when utilizing the wolfSSL backend until a patch is applied. This can be done by configuring the application to use traditional HTTP/2 or HTTP/1.1 protocols instead.
Conclusion
CVE-2025-5025 presents a significant security risk for users of libcurl who utilize QUIC connections with the wolfSSL backend. It is crucial to update to the latest version of the curl package to mitigate this vulnerability and ensure secure connections. Additionally, users should consider using alternative protocols until a patch is applied.
See every vulnerability recorded for curl →
FAQ
CVE-2025-5025 is a vulnerability in libcurl that affects the certificate pinning feature for QUIC connections when using the wolfSSL TLS backend.
Users may unknowingly connect to malicious servers without the protection of certificate pinning, leading to potential data theft or man-in-the-middle attacks.
You should update your curl package to the latest version that includes a fix for this vulnerability.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
