When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper check, thus not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2 built to use GnuTLS and the user had to explicitly disable the standard certificate verification.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Curl
  • Curl

No data.

No data.

References
Link Providers
https://curl.se/docs/CVE-2025-13034.html cve-icon cve-icon
https://curl.se/docs/CVE-2025-13034.json cve-icon cve-icon
History

Fri, 09 Jan 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Curl
Curl curl
Vendors & Products Curl
Curl curl

Thu, 08 Jan 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-295
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N'}

Thu, 08 Jan 2026 10:15:00 +0000

Type Values Removed Values Added
Description When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper check, thus not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2 built to use GnuTLS and the user had to explicitly disable the standard certificate verification.
Title No QUIC certificate pinning with GnuTLS
References
cve-icon MITRE

Status: PUBLISHED

Assigner: curl

Published: 2026-01-08T10:00:25.773Z

Updated: 2026-01-08T14:58:20.565Z

Reserved: 2025-11-11T16:52:22.121Z

Link: CVE-2025-13034

cve-icon Vulnrichment

Updated: 2026-01-08T14:57:30.418Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-01-08T10:15:45.407

Modified: 2026-01-08T18:08:18.457

Link: CVE-2025-13034

cve-icon Redhat

No data.