CVE-2025-5025 No QUIC certificate pinning with wolfSSL
Attackers can bypass certificate pinning in curl when using QUIC with wolfSSL, allowing connections to impostor servers without detection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-5025?
CVE-2025-5025 is a medium-severity vulnerability in Haxx Curl, published on 28 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.
Weakness: CWE-295
Which versions are affected by CVE-2025-5025?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2025-5025?
Apply the vendor's patch.
Is CVE-2025-5025 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-5025 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2025-5025, AZL-62038, CLEANSTART-2026-YC05676, CURL-CVE-2025-5025, DEBIAN-CVE-2025-5025, ECHO-fa7f-8ecf-75e7 and 3 more.