This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Curl fixes 2 vulnerabilities
Curl version 8.14.0 fixes 2 vulnerabilities in curl and libcurl [1][2].
An unauthenticated remote attacker can, due to a flaw in libcurl that skips certificate verification when connecting to a target host specified as an IP address while using wolfSSL as the TLS backend for QUIC connections, perform a man-in-the-middle attack, impersonate a trusted server and covertly obtain or modify transmitted data [1][3].
The vulnerability is present in product:
- curl; >=8.8.0, <=8.13.0
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
More information:
- CVE-2025-4947 at cve.org, NVD
- CWE-295: Improper Certificate Validation at cwe.mitre.org
The vulnerability was publicly disclosed 28. 5. 2025.
An unauthenticated remote attacker can exploit a missing public key pinning check when using QUIC with the wolfSSL TLS backend, which allows the curl client to establish an encrypted connection with a spoofed server without verifying that the public key matches the expected pin [2][4].
The vulnerability is present in product:
- curl; >=8.5.0, <=8.13.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2025-5025 at cve.org, NVD
- CWE-295: Improper Certificate Validation at cwe.mitre.org
The vulnerability was publicly disclosed 28. 5. 2025.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 28. 5. 2025.