CVE-2025-13034 Haxx CVE debrief

Who should care

Defenders and administrators using libcurl or curl with QUIC and ngtcp2 built to use GnuTLS should assess exposure and apply patches or updates. They should also review configurations to ensure proper public key verification and prevent potential exploitation. This includes verifying affected versions, applying patches, and updating configurations to mitigate the vulnerability.

Why it matters

CVE-2025-13034 is a vulnerability in libcurl and curl tool that allows for potential man-in-the-middle attacks when using QUIC and ngtcp2 built to use GnuTLS. Defenders should verify affected versions, apply patches, and update configurations to ensure proper public key verification.

• Potential man-in-the-middle attacks due to improper public key verification.
• Verification of affected versions and configurations is necessary.
• Patching or updating vulnerable versions is required to prevent exploitation.

Technical summary

The vulnerability occurs when using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool, allowing a connection without proper public key verification when QUIC and ngtcp2 built to use GnuTLS are used. This could enable potential man-in-the-middle attacks. Affected users should verify their configurations and apply patches or updates to mitigate the vulnerability. The issue arises from a specific condition that bypasses the public key verification process, highlighting the importance of reviewing and updating configurations.

Defensive priority

Defenders should prioritize verifying affected versions and applying patches, as the vulnerability allows for potential man-in-the-middle attacks.

Recommended defensive actions

• Verify if the system uses affected versions of libcurl or curl with QUIC and ngtcp2 built to use GnuTLS.
• Apply patches or updates provided by the vendor to fix the vulnerability.
• Review and update configurations to ensure proper public key verification.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions. The vulnerability affects libcurl and curl tool users with QUIC and ngtcp2 built to use GnuTLS. Defenders should verify affected versions, review configurations, and apply patches or updates to ensure proper public key verification. Evidence is limited to public sources, and further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.