Server Certificate Public Key Pinning Flaw in libcurl with wolfSSL for HTTP/3 Connections

CVE-2025-5025

What is CVE-2025-5025?

libcurl's implementation of server certificate public key pinning for HTTPS transfers is compromised when using QUIC for HTTP/3 connections with wolfSSL. Due to an oversight, the certificate pinning verification is not executed, allowing users to connect to potentially malicious servers without being alerted. Although documentation indicates compatibility with wolfSSL, it fails to clarify that this vulnerability exists specifically for QUIC and HTTP/3, thus increasing the risk of server impersonation for unwitting users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References