CVE-2025-13034
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
No QUIC certificate pinning with GnuTLS
When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool, curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper check, thus not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2 built to use GnuTLS and the user had to explicitly disable the standard certificate verification.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
curl
- Vendor
- curl
- Product
- curl
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 8.8.0 | affected | semver | 8.14.2 | Unavailable | None listed |
| 8.15.0 | affected | semver | 8.16.1 | Unavailable | None listed |
| 8.17.0 | affected | semver | 8.18.0 | Unavailable | None listed |
curl
- Vendor
- curl
- Product
- curl
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 3210101088dfa3d6a125d213226b092f2f866722 | affected | git | 3d91ca8cdb3b434226e743946d428b4dd3acf2c9 | Unavailable | None listed |
curl
- Vendor
- curl
- Product
- curl
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 8.17.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 8.16.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 8.15.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 8.14.1 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 8.14.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 8.13.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 8.12.1 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 8.12.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 8.11.1 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 8.11.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 8.10.1 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 8.10.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 8.9.1 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 8.9.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 8.8.0 | affected | Unavailable | Unavailable | Unavailable | None listed |