CVE-2025-5025

Name of the Vulnerable Software and Affected Versions libcurl (affected versions not specified)

Description The issue arises from an omission in libcurl's support for pinning the server certificate public key for HTTPS transfers when using QUIC for HTTP/3 with the wolfSSL TLS backend. Although the documentation suggests that this option works with wolfSSL, it fails to specify that the check is not performed in the context of QUIC and HTTP/3. As a result, users may unwittingly connect to an impostor server without noticing, since the transfer will succeed if the pin is fine.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.