Bug 2368888 (CVE-2025-5025) - CVE-2025-5025 curl: libcurl: QUIC Certificate Pinning Bypass
Summary: CVE-2025-5025 curl: libcurl: QUIC Certificate Pinning Bypass
Keywords:
Status: NEW
Alias: CVE-2025-5025
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-05-28 07:01 UTC by OSIDB Bzimport
Modified: 2025-05-30 19:10 UTC (History)
23 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-05-28 07:01:11 UTC 
libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.
Note You need to log in before you can comment on or make changes to this bug.