CVE-2025-4947: QUIC certificate check skip with wolfSSL
libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.
Other sources
QUIC certificate check skip with wolfSSL
— Microsoft
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4947?
CVE-2025-4947 is classified as a high severity vulnerability due to the potential for man-in-the-middle attacks.
How do I fix CVE-2025-4947?
To fix CVE-2025-4947, ensure that you are using a version of libcurl that properly verifies certificates for QUIC connections.
Which versions of libcurl are affected by CVE-2025-4947?
CVE-2025-4947 affects versions of libcurl that utilize QUIC connections when connecting to an IP address.
What types of attacks can CVE-2025-4947 enable?
CVE-2025-4947 can enable man-in-the-middle attacks, as it skips certificate verification for QUIC connections.
Does CVE-2025-4947 affect all libcurl users?
No, CVE-2025-4947 specifically affects libcurl users connecting to hosts via IP addresses, which may lead to vulnerabilities.