CVE-2025-5025: No QUIC certificate pinning with wolfSSL
libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.
Other sources
No QUIC certificate pinning with wolfSSL
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5025?
CVE-2025-5025 is classified as a medium severity vulnerability due to its potential impact on the security of HTTPS connections over QUIC using wolfSSL.
How do I fix CVE-2025-5025?
To fix CVE-2025-5025, ensure that you update to the latest version of libcurl or wolfSSL where the certificate public key pinning check is properly implemented for QUIC.
Which versions of libcurl are affected by CVE-2025-5025?
CVE-2025-5025 affects all versions of libcurl that use the wolfSSL backend without the proper implementation of certificate pinning for QUIC.
What should I be aware of regarding CVE-2025-5025 and QUIC connections?
You should be aware that CVE-2025-5025 can expose QUIC connections to man-in-the-middle attacks due to the lack of public key pinning.
Does CVE-2025-5025 affect non-QUIC connections?
CVE-2025-5025 specifically affects QUIC connections and does not impact traditional HTTP or HTTPS connections using libcurl.