CVE-2025-5025

Medium

Published: —Translated: 16/08/2026(UTC)NVD NIST

Summary

libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, but fails to specify that it does not for QUIC.

Risk Assessment

This may allow acceptance of unauthorized certificates in HTTP/3 connections, increasing the risk of man-in-the-middle attacks.

Recommendation

Update libcurl to a patched version and consider using a different TLS backend for QUIC connections.

Original NVD description (English source)

libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC a