CVE-2025-13034: No QUIC certificate pinning with GnuTLS
When using CURLOPTPINNEDPUBLICKEY option with libcurl or --pinnedpubkey with the curl tool,curl should check the public key of the server certificate to verify the peer.
This check was skipped in a certain condition that would then make curl allow the connection without performing the proper check, thus not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2 built to use GnuTLS and the user had to explicitly disable the standard certificate verification.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13034?
The severity of CVE-2025-13034 has not been officially categorized, but it pertains to inadequate verification of public keys, which may lead to security risks.
How do I fix CVE-2025-13034?
To fix CVE-2025-13034, ensure that you are using an updated version of libcurl where this vulnerability has been addressed.
What impact does CVE-2025-13034 have on affected users?
CVE-2025-13034 can potentially allow attackers to perform man-in-the-middle attacks by bypassing public key verification.
Which versions of libcurl are affected by CVE-2025-13034?
CVE-2025-13034 affects all versions of libcurl that implement the CURLOPT_PINNEDPUBLICKEY option with the noted vulnerability.
Is CVE-2025-13034 related to secure communication?
Yes, CVE-2025-13034 is related to secure communication as it involves the verification of public keys which are crucial for establishing secure connections.