Multiple vulnerabilities in cURL

Published: 2025-05-28

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2025-5025 CVE-2025-4947
CWE-ID	CWE-295
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	cURL Client/Desktop applications / Other client software
Vendor	curl.haxx.se

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Improper Certificate Validation

EUVDB-ID: #VU109885

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-5025

CWE-ID: CWE-295 - Improper Certificate Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to libcurl does not perform pinning of the server certificate public key for HTTPS transfers when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. A remote attacker can perform Man-in-the-middle (MitM) attack and track the victim into connecting to a malicious server.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

cURL: 8.5.0 - 8.13.0

CPE2.3

External links

https://curl.se/docs/CVE-2025-5025.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper Certificate Validation

EUVDB-ID: #VU109884

Risk: Low

CVSSv4.0: 0.6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-4947