CVE-2025-4947

Medium CVSS: 6.5

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

Vendor

Haxx

Product

Curl

CWE

CWE-295

Yayın Tarihi

2025-05-28 07:15:24

Güncelleme

2025-06-26 15:08:21

Source Identifier

2499f714-1537-4658-8207-48ae4bb9eae9

KEV Date Added

Kategoriler

CWE-295 Curl MEDIUM Haxx 2025

Referanslar

https://curl.se/docs/CVE-2025-4947.html https://curl.se/docs/CVE-2025-4947.json https://hackerone.com/reports/3150884 http://www.openwall.com/lists/oss-security/2025/05/28/4

Benzer Kayıtlar

Medium

CVE-2026-3783

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl…

Medium

CVE-2026-3784

curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses diffe…

High

CVE-2026-3805

When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already free…

Medium

CVE-2026-1965

libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS r…

Medium

CVE-2025-15079

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenl…

Low

CVE-2025-15224

When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly s…