---
id: CVE-2025-13034
title: |-
  When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`
  with the curl tool, curl should check the public key of the server certificate
  to verify the peer.

  This check was skipped in a certain condition that would the…
summary: |-
  When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`
  with the curl tool, curl should check the public key of the server certificate
  to verify the peer.

  This check was skipped in a certain condition that would the…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-295
vendor: haxx
product: curl
affected:
  - 'curl >= 8.8.0, < 8.18.0'
patched:
  - curl 8.18.0
published: '2026-01-08'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T07:16:23.550'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-13034'
references:
  - url: 'https://curl.se/docs/CVE-2025-13034.html'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://curl.se/docs/CVE-2025-13034.json'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13034.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-13034'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2426406'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-13034'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-13034'
  - url: 'https://access.redhat.com/errata/RHSA-2026:6893'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-01-08T14:56:11.206224Z'
epss: 0.00242
epssPercentile: 0.15674
ingestedAt: '2026-09-15T07:33:29.257Z'
scores:
  nvd: 5.9
  vendor: 6.8
---

## Overview

When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`
with the curl tool, curl should check the public key of the server certificate
to verify the peer.

This check was skipped in a certain condition that would then make curl allow
the connection without performing the proper check, thus not noticing a
possible impostor. To skip this check, the connection had to be done with QUIC
with ngtcp2 built to use GnuTLS and the user had to explicitly disable the
standard certificate verification.

## Affected

- `curl >= 8.8.0, < 8.18.0`

## Remediation

Upgrade past the affected range:

- `curl 8.18.0`

## Vendor advisories

- **RHSA-2026:6893** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:6893)
- **Red Hat VEX** · Moderate · affected: Confidential Compute Attestation, Logging Subsystem for Red Hat OpenShift, OpenShift Service Mesh 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, … · no fix planned: Confidential Compute Attestation, Logging Subsystem for Red Hat OpenShift, OpenShift Service Mesh 2, Red Hat Enterprise Linux 10, … · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13034.json)