{"id":"CVE-2025-13034","title":"When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool, curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would the…","summary":"When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool, curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would the…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-295"],"vendor":"haxx","product":"curl","affected":["curl >= 8.8.0, < 8.18.0"],"patched":["curl 8.18.0"],"published":"2026-01-08","updated":"2026-09-15","sourceUpdated":"2026-09-15T07:16:23.550","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-13034","references":[{"url":"https://curl.se/docs/CVE-2025-13034.html","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"https://curl.se/docs/CVE-2025-13034.json","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13034.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-13034"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426406"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-13034"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13034"},{"url":"https://access.redhat.com/errata/RHSA-2026:6893"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-01-08T14:56:11.206224Z"},"epss":0.00242,"epssPercentile":0.15674,"ingestedAt":"2026-09-15T07:33:29.257Z","scores":{"nvd":5.9,"vendor":6.8},"slug":"CVE-2025-13034","body":"## Overview\n\nWhen using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool, curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification.\n\n## Affected\n\n- `curl >= 8.8.0, < 8.18.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `curl 8.18.0`\n\n## Vendor advisories\n\n- **RHSA-2026:6893** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:6893)\n- **Red Hat VEX** · Moderate · affected: Confidential Compute Attestation, Logging Subsystem for Red Hat OpenShift, OpenShift Service Mesh 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, … · no fix planned: Confidential Compute Attestation, Logging Subsystem for Red Hat OpenShift, OpenShift Service Mesh 2, Red Hat Enterprise Linux 10, … · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13034.json)","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":32.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}