CVE-2025-4947: Haxx Curl Information Disclosure Flaw

CVE-2025-4947 Overview

CVE-2025-4947 is a certificate validation bypass vulnerability in libcurl that affects QUIC protocol connections. When a user or application connects to a host specified as an IP address in the URL, libcurl accidentally skips the certificate verification process entirely. This security flaw allows potential attackers to conduct man-in-the-middle (MITM) attacks or impersonate legitimate servers without detection.

Critical Impact
Applications using libcurl with QUIC protocol support and IP address-based URLs are vulnerable to man-in-the-middle attacks, potentially exposing sensitive data transmitted over what should be secure connections.

Affected Products

Haxx curl (libcurl with QUIC support)
Applications and services built using affected libcurl versions
Systems where curl is compiled with QUIC/HTTP/3 backend support

Discovery Timeline

2025-05-28 - CVE-2025-4947 published to NVD
2025-06-26 - Last updated in NVD database

Technical Details for CVE-2025-4947

Vulnerability Analysis

This vulnerability represents a critical flaw in libcurl's TLS certificate verification logic specifically affecting QUIC connections. Under normal circumstances, when establishing a secure connection, libcurl verifies the server's TLS certificate to ensure the connection is made to the intended host. However, a coding error causes this verification step to be bypassed when the target host is specified as an IP address rather than a hostname.

The vulnerability is classified under CWE-295 (Improper Certificate Validation), indicating a fundamental failure in the certificate verification process. This allows an attacker positioned between the client and server to intercept, read, and potentially modify encrypted communications without raising any security warnings.

Root Cause

The root cause lies in libcurl's handling of the certificate verification code path for QUIC connections. When a URL contains an IP address (e.g., https://192.168.1.1/) instead of a hostname, the code incorrectly skips the certificate verification step. This appears to be an oversight in the implementation where the IP address scenario was not properly handled in the QUIC-specific verification logic.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by positioning themselves in the network path between a vulnerable client and its intended destination. The attack scenario proceeds as follows:

The victim application initiates a QUIC connection to a server using an IP address URL
The attacker intercepts the connection request via ARP spoofing, DNS poisoning, or network position
The attacker presents their own certificate to the client
Due to the vulnerability, libcurl does not verify the certificate and accepts the connection
The attacker can now intercept all traffic, potentially stealing credentials or injecting malicious content

Since no code examples are available from verified sources, organizations should refer to the official cURL security advisory for detailed technical information about the vulnerability mechanism.

Detection Methods for CVE-2025-4947

Indicators of Compromise

Unexpected certificate warnings or errors in network monitoring tools for QUIC traffic
Network traffic analysis showing QUIC connections to IP addresses without proper TLS handshake verification
Anomalous QUIC/HTTP/3 connections originating from systems that typically use hostname-based URLs
Evidence of ARP spoofing or network interception targeting systems using curl with QUIC

Detection Strategies

Monitor network traffic for QUIC connections made directly to IP addresses rather than hostnames
Implement certificate transparency log monitoring to detect suspicious certificate usage
Deploy network intrusion detection systems (NIDS) configured to alert on potential MITM patterns
Audit application configurations to identify curl usage with IP address-based URLs and QUIC enabled

Monitoring Recommendations

Enable verbose logging in curl-based applications to track certificate verification behavior
Implement network segmentation to limit the impact of potential MITM attacks
Monitor for unusual patterns in QUIC traffic that may indicate certificate verification is being bypassed
Review application logs for connections to IP addresses using QUIC protocol

How to Mitigate CVE-2025-4947

Immediate Actions Required

Update curl and libcurl to the latest patched version as soon as available from the vendor
Review and audit applications that use libcurl with QUIC support for IP address-based URL usage
Consider temporarily disabling QUIC/HTTP/3 support in critical applications until patched
Use hostname-based URLs instead of IP addresses where possible as a temporary mitigation

Patch Information

Haxx has released information about this vulnerability through their official security advisory. Organizations should consult the cURL CVE-2025-4947 Advisory for detailed patch information and apply updates according to their guidance. The vulnerability details are also available in the HackerOne Report #3150884.

Workarounds

Avoid using IP addresses directly in URLs when making QUIC connections; use hostnames instead
Disable QUIC/HTTP/3 support in curl by removing the --http3 flag or equivalent library option
Implement additional certificate pinning at the application layer for critical connections
Use network-level controls to enforce certificate validation through proxy or gateway devices

bash

# Disable HTTP/3 (QUIC) to mitigate the vulnerability
# When using curl command line, avoid --http3 flag
curl --http2 https://example.com/

# For libcurl applications, ensure QUIC is disabled
# Set CURLOPT_HTTP_VERSION to CURL_HTTP_VERSION_2_0 or lower
# Example curl configuration to force HTTP/2
curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);