CVE-2025-13034

Jan. 8, 2026, 6:08 p.m.

5.9
Medium

Description

When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper check, thus not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2 built to use GnuTLS and the user had to explicitly disable the standard certificate verification.

Product(s) Impacted

Vendor Product Versions
Curl
  • Curl
  • Libcurl
  • *
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-295
Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a curl curl / / / / / / / /
a curl libcurl / / / / / / / /

References

https://curl.se/docs/CVE-2025-13034.html
https://curl.se/docs/CVE-2025-13034.json

Tags

CWE-295
2499f714-1537-4658-8207-48ae4bb9eae9
2026-01-08
CVE-2025-13034

CVSS Score

5.9 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: HIGH
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: HIGH
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

    View Vector String

Timeline

Published: Jan. 8, 2026, 10:15 a.m.
Last Modified: Jan. 8, 2026, 6:08 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

2499f714-1537-4658-8207-48ae4bb9eae9

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.