CVE-2025-13034
Gravedad CVSS v3.1:
MEDIA
Tipo:
CWE-295
Validación incorrecta de certificados
Fecha de publicación:
08/01/2026
Última modificación:
08/01/2026
Descripción
*** Pendiente de traducción *** When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`<br />
with the curl tool,curl should check the public key of the server certificate<br />
to verify the peer.<br />
<br />
This check was skipped in a certain condition that would then make curl allow<br />
the connection without performing the proper check, thus not noticing a<br />
possible impostor. To skip this check, the connection had to be done with QUIC<br />
with ngtcp2 built to use GnuTLS and the user had to explicitly disable the<br />
standard certificate verification.
Impacto
Puntuación base 3.x
5.90
Gravedad 3.x
MEDIA