CISA-2025-4947 — Vulnetix

CISA-2025-4947 PUBLISHED CVSS 6.5 MEDIUM

Reported by curl · Published May 28, 2025

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

Risk Scores

CVSS 3.1

6.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected Products

Vendor	Product	Versions
curl	curl	8.13.0, 8.12.1, 8.12.0
curl	curl	8.12.1, 8.12.0, 8.11.1

Timeline

May 28, 2025 CVE Published
May 28, 2025 CVE Updated

References

json
www
issue
http://www.openwall.com/lists/oss-security/2025/05/28/4 url

Open in Interactive Console →