CVE-2025-4947
QUIC certificate check skip with wolfSSL
Project curl Security Advisory, May 28 2025 - Permalink
VULNERABILITY
libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.
INFO
curl can get built to use one out of twelve different TLS libraries. The selection is done both at build-time and also optionally at runtime. This vulnerability only affects curl made to use this specific TLS backend.
This flaw requires wolfSSL to be used as the TLS backend for QUIC to trigger.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2025-4947 to this issue.
CWE-295: Improper Certificate Validation
Severity: Medium
AFFECTED VERSIONS
- Affected versions: curl 8.8.0 to and including 8.13.0
- Not affected versions: curl < 8.8.0 and >= 8.14.0
- Introduced-in: https://github.com/curl/curl/commit/4c46e277b2a0c0489
Beware that while curl versions before 8.8.0 are not considered vulnerable to this flaw, certificate verification still did not work correctly then and was documented to not work.
libcurl is used by many applications, but not always advertised as such!
This bug is not considered a C mistake. It is not likely to have been avoided had we not been using C.
This flaw also affects the curl command line tool.
SOLUTION
Starting in curl 8.14.0, this mistake is fixed.
RECOMMENDATIONS
A - Upgrade curl to version 8.14.0
B - Apply the patch to your local version
C - Avoid using HTTP/3 with curl built to use wolfSSL
TIMELINE
This issue was reported to the curl project on May 17, 2025. We contacted distros@openwall on May 20, 2025.
curl 8.14.0 was released on May 28 2025 around 07:00 UTC, coordinated with the publication of this advisory.
The curl security team is not aware of any active exploits using this vulnerability.
CREDITS
- Reported-by: Hiroki Kurosawa
- Patched-by: Stefan Eissing
Thanks a lot!