Vulnerability-Lookup

CVE-2025-13034 (GCVE-0-2025-13034)

Vulnerability from cvelistv5 – Published: 2026-01-08 10:00 – Updated: 2026-09-15 06:02

Title

No QUIC certificate pinning with GnuTLS

Summary

When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool, curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper check, thus not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2 built to use GnuTLS and the user had to explicitly disable the standard certificate verification.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-08 14:56 UTC

CWE

CWE-295 - Improper Certificate Validation

Assigner

curl redhat root

References

2 references

URL	Tags
https://curl.se/docs/CVE-2025-13034.json
https://curl.se/docs/CVE-2025-13034.html

Impacted products

3 products

Vendor	Product	Version	CPE status
curl	curl	Affected: 8.8.0 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.18.0 (semver)	guessed
curl	curl	Affected: 3210101088dfa3d6a125d213226b092f2f866722 , < 3d91ca8cdb3b434226e743946d428b4dd3acf2c9 (git)	guessed
curl	curl	Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0	guessed

Credits

Stanislav Fort (Aisle Research) Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-13034",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-08T14:56:11.206224Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-295",
                "description": "CWE-295 Improper Certificate Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-08T14:58:20.565Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "8.8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.18.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "3d91ca8cdb3b434226e743946d428b4dd3acf2c9",
              "status": "affected",
              "version": "3210101088dfa3d6a125d213226b092f2f866722",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Stanislav Fort (Aisle Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool, curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:02:26.327Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2025-13034.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2025-13034.html"
        }
      ],
      "title": "No QUIC certificate pinning with GnuTLS",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "8.8.0"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.1"
                  },
                  {
                    "introduced": "8.17.0"
                  },
                  {
                    "fixed": "8.18.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "3210101088dfa3d6a125d213226b092f2f866722"
                  },
                  {
                    "fixed": "3d91ca8cdb3b434226e743946d428b4dd3acf2c9"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.17.0",
              "8.16.0",
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1",
              "8.11.0",
              "8.10.1",
              "8.10.0",
              "8.9.1",
              "8.9.0",
              "8.8.0"
            ]
          }
        ],
        "aliases": [
          "CVE-2025-13034"
        ],
        "credits": [
          {
            "name": "Stanislav Fort (Aisle Research)",
            "type": "finder"
          },
          {
            "name": "Daniel Stenberg",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Improper Certificate Validation",
            "id": "CWE-295"
          },
          "URL": "https://curl.se/docs/CVE-2025-13034.json",
          "affects": "both",
          "award": {
            "amount": "2540",
            "currency": "USD"
          },
          "last_affected": "8.17.0",
          "package": "curl",
          "severity": "Medium",
          "www": "https://curl.se/docs/CVE-2025-13034.html"
        },
        "details": "When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool, curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification.",
        "id": "CURL-CVE-2025-13034",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2026-01-07T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "No QUIC certificate pinning with GnuTLS"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2025-13034",
    "datePublished": "2026-01-08T10:00:25.773Z",
    "dateReserved": "2025-11-11T16:52:22.121Z",
    "dateUpdated": "2026-09-15T06:02:26.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-13034",
      "date": "2026-09-19",
      "epss": "0.00242",
      "percentile": "0.15721"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T04:14:52.000Z",
      "cve": "CVE-2025-13034",
      "id": "msrc_CVE-2025-13034",
      "initial_release_date": "2026-01-02T00:00:00.000Z",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "12",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "No QUIC certificate pinning with GnuTLS",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2025-13034.json",
      "version": "6"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "curl",
                "vendor": "curl",
                "versions": [
                  {
                    "lessThan": "8.14.2",
                    "status": "affected",
                    "version": "8.8.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "8.16.1",
                    "status": "affected",
                    "version": "8.15.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "8.18.0",
                    "status": "affected",
                    "version": "8.17.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "curl",
                "repo": "https://github.com/curl/curl.git",
                "vendor": "curl",
                "versions": [
                  {
                    "lessThan": "3d91ca8cdb3b434226e743946d428b4dd3acf2c9",
                    "status": "affected",
                    "version": "3210101088dfa3d6a125d213226b092f2f866722",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "curl",
                "vendor": "curl",
                "versions": [
                  {
                    "status": "affected",
                    "version": "8.17.0"
                  },
                  {
                    "status": "affected",
                    "version": "8.16.0"
                  },
                  {
                    "status": "affected",
                    "version": "8.15.0"
                  },
                  {
                    "status": "affected",
                    "version": "8.14.1"
                  },
                  {
                    "status": "affected",
                    "version": "8.14.0"
                  },
                  {
                    "status": "affected",
                    "version": "8.13.0"
                  },
                  {
                    "status": "affected",
                    "version": "8.12.1"
                  },
                  {
                    "status": "affected",
                    "version": "8.12.0"
                  },
                  {
                    "status": "affected",
                    "version": "8.11.1"
                  },
                  {
                    "status": "affected",
                    "version": "8.11.0"
                  },
                  {
                    "status": "affected",
                    "version": "8.10.1"
                  },
                  {
                    "status": "affected",
                    "version": "8.10.0"
                  },
                  {
                    "status": "affected",
                    "version": "8.9.1"
                  },
                  {
                    "status": "affected",
                    "version": "8.9.0"
                  },
                  {
                    "status": "affected",
                    "version": "8.8.0"
                  }
                ]
              }
            ],
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E6152C75-3784-4E17-A770-4585D1FD80C4",
                    "versionEndExcluding": "8.18.0",
                    "versionStartIncluding": "8.8.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool, curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification."
          },
          {
            "lang": "es",
            "value": "Al usar la opci\u00f3n \u0027CURLOPT_PINNEDPUBLICKEY\u0027 con libcurl o \u0027--pinnedpubkey\u0027 con la herramienta curl, curl deber\u00eda verificar la clave p\u00fablica del certificado del servidor para verificar el par.\n\nEsta verificaci\u00f3n se omiti\u00f3 en una determinada condici\u00f3n que luego har\u00eda que curl permitiera la conexi\u00f3n sin realizar la verificaci\u00f3n adecuada, sin notar as\u00ed un posible impostor. Para omitir esta verificaci\u00f3n, la conexi\u00f3n ten\u00eda que hacerse con QUIC con ngtcp2 compilado para usar GnuTLS y el usuario ten\u00eda que deshabilitar expl\u00edcitamente la verificaci\u00f3n est\u00e1ndar del certificado."
          }
        ],
        "id": "CVE-2025-13034",
        "lastModified": "2026-09-15T07:16:23.550",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-13034",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-08T14:56:11.206224Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-01-08T10:15:45.407",
        "references": [
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://curl.se/docs/CVE-2025-13034.html"
          },
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://curl.se/docs/CVE-2025-13034.json"
          }
        ],
        "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-295"
              }
            ],
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-295"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T06:51:54+00:00",
      "cve": "CVE-2025-13034",
      "id": "CVE-2025-13034",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:fixed": "3",
      "product_status:known_affected": "105",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "curl: Public key pinning bypass via QUIC and GnuTLS allows server impersonation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13034.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:19:28Z",
      "cve": "CVE-2025-13034",
      "id": "CVE-2025-13034",
      "initial_release_date": "2026-01-08T00:32:25Z",
      "product_status:known_not_affected": "251",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-13034",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-13034.json",
      "version": "12"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "HIGH",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 5.9,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-13034",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-01-08T14:56:11.206224Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-295",
                    "description": "CWE-295 Improper Certificate Validation",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-01-08T14:57:30.418Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "curl",
              "vendor": "curl",
              "versions": [
                {
                  "lessThan": "8.14.2",
                  "status": "affected",
                  "version": "8.8.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "8.16.1",
                  "status": "affected",
                  "version": "8.15.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "8.18.0",
                  "status": "affected",
                  "version": "8.17.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "curl",
              "repo": "https://github.com/curl/curl.git",
              "vendor": "curl",
              "versions": [
                {
                  "lessThan": "3d91ca8cdb3b434226e743946d428b4dd3acf2c9",
                  "status": "affected",
                  "version": "3210101088dfa3d6a125d213226b092f2f866722",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "curl",
              "vendor": "curl",
              "versions": [
                {
                  "status": "affected",
                  "version": "8.17.0"
                },
                {
                  "status": "affected",
                  "version": "8.16.0"
                },
                {
                  "status": "affected",
                  "version": "8.15.0"
                },
                {
                  "status": "affected",
                  "version": "8.14.1"
                },
                {
                  "status": "affected",
                  "version": "8.14.0"
                },
                {
                  "status": "affected",
                  "version": "8.13.0"
                },
                {
                  "status": "affected",
                  "version": "8.12.1"
                },
                {
                  "status": "affected",
                  "version": "8.12.0"
                },
                {
                  "status": "affected",
                  "version": "8.11.1"
                },
                {
                  "status": "affected",
                  "version": "8.11.0"
                },
                {
                  "status": "affected",
                  "version": "8.10.1"
                },
                {
                  "status": "affected",
                  "version": "8.10.0"
                },
                {
                  "status": "affected",
                  "version": "8.9.1"
                },
                {
                  "status": "affected",
                  "version": "8.9.0"
                },
                {
                  "status": "affected",
                  "version": "8.8.0"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Stanislav Fort (Aisle Research)"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Daniel Stenberg"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool, curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-295",
                  "description": "Improper Certificate Validation",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-15T06:02:26.327Z",
            "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "shortName": "curl"
          },
          "references": [
            {
              "url": "https://curl.se/docs/CVE-2025-13034.json"
            },
            {
              "url": "https://curl.se/docs/CVE-2025-13034.html"
            }
          ],
          "title": "No QUIC certificate pinning with GnuTLS",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_osv": {
            "affected": [
              {
                "ranges": [
                  {
                    "events": [
                      {
                        "introduced": "8.8.0"
                      },
                      {
                        "fixed": "8.14.2"
                      },
                      {
                        "introduced": "8.15.0"
                      },
                      {
                        "fixed": "8.16.1"
                      },
                      {
                        "introduced": "8.17.0"
                      },
                      {
                        "fixed": "8.18.0"
                      }
                    ],
                    "type": "SEMVER"
                  },
                  {
                    "events": [
                      {
                        "introduced": "3210101088dfa3d6a125d213226b092f2f866722"
                      },
                      {
                        "fixed": "3d91ca8cdb3b434226e743946d428b4dd3acf2c9"
                      }
                    ],
                    "repo": "https://github.com/curl/curl.git",
                    "type": "GIT"
                  }
                ],
                "versions": [
                  "8.17.0",
                  "8.16.0",
                  "8.15.0",
                  "8.14.1",
                  "8.14.0",
                  "8.13.0",
                  "8.12.1",
                  "8.12.0",
                  "8.11.1",
                  "8.11.0",
                  "8.10.1",
                  "8.10.0",
                  "8.9.1",
                  "8.9.0",
                  "8.8.0"
                ]
              }
            ],
            "aliases": [
              "CVE-2025-13034"
            ],
            "credits": [
              {
                "name": "Stanislav Fort (Aisle Research)",
                "type": "finder"
              },
              {
                "name": "Daniel Stenberg",
                "type": "remediation developer"
              }
            ],
            "database_specific": {
              "CWE": {
                "desc": "Improper Certificate Validation",
                "id": "CWE-295"
              },
              "URL": "https://curl.se/docs/CVE-2025-13034.json",
              "affects": "both",
              "award": {
                "amount": "2540",
                "currency": "USD"
              },
              "last_affected": "8.17.0",
              "package": "curl",
              "severity": "Medium",
              "www": "https://curl.se/docs/CVE-2025-13034.html"
            },
            "details": "When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool, curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification.",
            "id": "CURL-CVE-2025-13034",
            "modified": "2026-09-07T10:34:51.00Z",
            "published": "2026-01-07T08:00:00.00Z",
            "schema_version": "1.5.0",
            "summary": "No QUIC certificate pinning with GnuTLS"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "assignerShortName": "curl",
        "cveId": "CVE-2025-13034",
        "datePublished": "2026-01-08T10:00:25.773Z",
        "dateReserved": "2025-11-11T16:52:22.121Z",
        "dateUpdated": "2026-09-15T06:02:26.327Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0796

Vulnerability from certfr_avis - Published: 2026-06-24 - Updated: 2026-06-24

De multiples vulnérabilités ont été découvertes dans Tenable Identity Exposure. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Tenable	Identity Exposure	Tenable Identity Exposure versions antérieures à v3.93.5

References

Title

Publication Time

CERTFR-2026-AVI-1125

Vulnerability from certfr_avis - Published: 2026-09-07 - Updated: 2026-09-07

De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
VMware	Open Source RabbitMQ	Open Source RabbitMQ versions 4.2.x antérieur à 4.2.10
VMware	Open Source RabbitMQ	Open Source RabbitMQ versions 4.3.x antérieur à 4.3.5
VMware	Open Source RabbitMQ	Open Source RabbitMQ versions 4.0.x antérieur à 4.0.24
VMware	Tanzu	Tanzu for Valkey sur Kubernetes versions antérieures à 13.5.0
VMware	Open Source RabbitMQ	Open Source RabbitMQ versions 4.1.x antérieur à 4.1.15
VMware	Open Source RabbitMQ	Open Source RabbitMQ versions antérieur à 3.13.19

References

Title

Publication Time

FKIE_CVE-2025-13034

Vulnerability from fkie_nvd - Published: 2026-01-08 10:15 - Updated: 2026-09-15 07:16

Severity

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

References

	URL	Tags
	2499f714-1537-4658-8207-48ae4bb9eae9	https://curl.se/docs/CVE-2025-13034.html	Patch, Vendor Advisory
	2499f714-1537-4658-8207-48ae4bb9eae9	https://curl.se/docs/CVE-2025-13034.json	Vendor Advisory

Impacted products

	Vendor	Product	Version
	haxx	curl	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "8.8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.18.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "3d91ca8cdb3b434226e743946d428b4dd3acf2c9",
              "status": "affected",
              "version": "3210101088dfa3d6a125d213226b092f2f866722",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            }
          ]
        }
      ],
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E6152C75-3784-4E17-A770-4585D1FD80C4",
              "versionEndExcluding": "8.18.0",
              "versionStartIncluding": "8.8.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool, curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification."
    },
    {
      "lang": "es",
      "value": "Al usar la opci\u00f3n \u0027CURLOPT_PINNEDPUBLICKEY\u0027 con libcurl o \u0027--pinnedpubkey\u0027 con la herramienta curl, curl deber\u00eda verificar la clave p\u00fablica del certificado del servidor para verificar el par.\n\nEsta verificaci\u00f3n se omiti\u00f3 en una determinada condici\u00f3n que luego har\u00eda que curl permitiera la conexi\u00f3n sin realizar la verificaci\u00f3n adecuada, sin notar as\u00ed un posible impostor. Para omitir esta verificaci\u00f3n, la conexi\u00f3n ten\u00eda que hacerse con QUIC con ngtcp2 compilado para usar GnuTLS y el usuario ten\u00eda que deshabilitar expl\u00edcitamente la verificaci\u00f3n est\u00e1ndar del certificado."
    }
  ],
  "id": "CVE-2025-13034",
  "lastModified": "2026-09-15T07:16:23.550",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-13034",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-01-08T14:56:11.206224Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-01-08T10:15:45.407",
  "references": [
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://curl.se/docs/CVE-2025-13034.html"
    },
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://curl.se/docs/CVE-2025-13034.json"
    }
  ],
  "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ],
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-9R76-QJ98-JFHC

Vulnerability from github – Published: 2026-01-08 12:30 – Updated: 2026-01-08 15:31

Details

When using CURLOPT_PINNEDPUBLICKEY option with libcurl or --pinnedpubkey with the curl tool,curl should check the public key of the server certificate to verify the peer.

This check was skipped in a certain condition that would then make curl allow the connection without performing the proper check, thus not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2 built to use GnuTLS and the user had to explicitly disable the standard certificate verification.

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-13034"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-08T10:15:45Z",
    "severity": "MODERATE"
  },
  "details": "When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool,curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification.",
  "id": "GHSA-9r76-qj98-jfhc",
  "modified": "2026-01-08T15:31:25Z",
  "published": "2026-01-08T12:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13034"
    },
    {
      "type": "WEB",
      "url": "https://curl.se/docs/CVE-2025-13034.html"
    },
    {
      "type": "WEB",
      "url": "https://curl.se/docs/CVE-2025-13034.json"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2025-13034

Vulnerability from csaf_microsoft - Published: 2026-01-02 00:00 - Updated: 2026-02-21 04:14

Summary

No QUIC certificate pinning with GnuTLS

Scope

1 vulnerability in this advisory, including CVE-2025-13034.

CVE-2025-13034

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Known affected: 1 product Known not affected: 12 products

Open the full advisory

RHSA-2026:6893

Vulnerability from csaf_redhat - Published: 2026-04-07 15:43 - Updated: 2026-09-18 17:44

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Moderate

Scope

13 vulnerabilities in this advisory, including CVE-2025-13034.

CVE-2025-13034

A flaw was found in curl. When configured to use public key pinning with QUIC connections and GnuTLS, and with standard certificate verification explicitly disabled, curl could bypass the intended public key check. This oversight allows a malicious server to impersonate a legitimate one, potentially leading to unauthorized access or information disclosure due to a failure in verifying the server's identity.

6.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Fixed: 3 products

https://access.redhat.com/errata/RHSA-2026:6893

Open the full advisory

UBUNTU-CVE-2025-13034 (CVE-2025-13034)

Vulnerability from osv_ubuntu – Published: 2026-01-06 07:00 – Updated: 2026-04-22 07:53 – Source website

Details

When using CURLOPT_PINNEDPUBLICKEY option with libcurl or --pinnedpubkey with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper check, thus not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2 built to use GnuTLS and the user had to explicitly disable the standard certificate verification.

Severity

5.9 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2025-13034	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-13034	REPORT
	https://curl.se/docs/CVE-2025-13034.html	REPORT
	https://ubuntu.com/security/notices/USN-8062-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "8.14.1-2ubuntu1.1"
          },
          {
            "binary_name": "libcurl3t64-gnutls",
            "binary_version": "8.14.1-2ubuntu1.1"
          },
          {
            "binary_name": "libcurl4t64",
            "binary_version": "8.14.1-2ubuntu1.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@8.14.1-2ubuntu1.1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.14.1-2ubuntu1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.12.1-3ubuntu1",
        "8.13.0-5ubuntu1",
        "8.14.1-1ubuntu2",
        "8.14.1-1ubuntu3",
        "8.14.1-2ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper check, thus not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2 built to use GnuTLS and the user had to explicitly disable the standard certificate verification.",
  "id": "UBUNTU-CVE-2025-13034",
  "modified": "2026-04-22T07:53:20Z",
  "published": "2026-01-06T07:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-13034"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-13034"
    },
    {
      "type": "REPORT",
      "url": "https://curl.se/docs/CVE-2025-13034.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8062-1"
    }
  ],
  "related": [
    "USN-8062-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2025-13034"
  ]
}

WID-SEC-W-2026-0030

Vulnerability from csaf_certbund - Published: 2026-01-06 23:00 - Updated: 2026-05-18 22:00

Summary

cURL: Mehrere Schwachstellen

Severity

Mittel

Scope

6 vulnerabilities in this advisory, including CVE-2025-13034.

CVE-2025-13034

Known affected: 16 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-13034 (GCVE-0-2025-13034)

CERTFR-2026-AVI-0796

Solutions

CERTFR-2026-AVI-1125

Solutions

FKIE_CVE-2025-13034

GHSA-9R76-QJ98-JFHC

MSRC_CVE-2025-13034

RHSA-2026:6893

UBUNTU-CVE-2025-13034 (CVE-2025-13034)

WID-SEC-W-2026-0030

Tags

Sightings

Nomenclature

Related by attack behaviour