CVE-2025-13034 No QUIC certificate pinning with GnuTLS
Attackers can bypass certificate pinning in curl when using QUIC with GnuTLS and disabled verification, allowing man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-13034?
CVE-2025-13034 is a medium-severity vulnerability in Haxx Curl, published on 8 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool, curl should check the public key of the server certificate to verify the peer.
This check was skipped in a certain condition that would then make curl allow the connection without performing the proper check, thus not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2 built to use GnuTLS and the user had to explicitly disable the standard certificate verification.
Weakness: CWE-295
Which versions are affected by CVE-2025-13034?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2025-13034?
Apply the vendor's patch.
Is CVE-2025-13034 being exploited?
There is no known exploitation of CVE-2025-13034 in the wild and no public exploit code.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2025-13034, CURL-CVE-2025-13034, DEBIAN-CVE-2025-13034, GHSA-9r76-qj98-jfhc, JLSEC-2026-426, MINI-c73v-v84q-fmgc and 1 more.