CVE-2025-4947

MEDIUM

Haxx Curl < 8.14.0 - Improper Certificate Validation

Title source: rule

Description

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

References (4)

[Patch, Vendor Advisory] https://curl.se/docs/CVE-2025-4947.html

[Vendor Advisory] https://curl.se/docs/CVE-2025-4947.json

[Exploit, Issue Tracking, Patch] https://hackerone.com/reports/3150884

[Mailing List, Patch, Third Party Advisory] http://www.openwall.com/lists/oss-security/2025/05/28/4

Scores

CVSS v3 6.5

EPSS 0.0004

EPSS Percentile 10.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Classification

CWE

CWE-295

Status published

Affected Products (1)

haxx/curl < 8.14.0

Timeline

Published May 28, 2025

Tracked Since Feb 18, 2026