CVE-2025-5025

Katalog CVE

CVSS 4.8 · Medium EPSS 0,29%

Kerentanan Improper Certificate Validation pada haxx curl. Skor CVSS 3.1 4.8 (Medium) menurut CISA ADP.

Deskripsi (NVD)

libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.

Rincian

Terbit di NVD

28 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.8 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 20,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://curl.se/docs/CVE-2025-5025.html advisory vendor
• https://curl.se/docs/CVE-2025-5025.json advisory vendor
• https://hackerone.com/reports/3153497 exploit · issue tracking · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2025/05/28/5 mailing list · advisory pihak ketiga