CVE-2025-13034
Severity CVSS v4.0:
Pending analysis
Type:
CWE-295
Improper Certificate Validation
Publication date:
08/01/2026
Last modified:
08/01/2026
Description
When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`<br />
with the curl tool,curl should check the public key of the server certificate<br />
to verify the peer.<br />
<br />
This check was skipped in a certain condition that would then make curl allow<br />
the connection without performing the proper check, thus not noticing a<br />
possible impostor. To skip this check, the connection had to be done with QUIC<br />
with ngtcp2 built to use GnuTLS and the user had to explicitly disable the<br />
standard certificate verification.
Impact
Base Score 3.x
5.90
Severity 3.x
MEDIUM