CVE-2025-5025: Haxx Curl Information Disclosure Flaw

CVE-2025-5025 Overview

CVE-2025-5025 is a certificate validation bypass vulnerability affecting libcurl when using the wolfSSL TLS backend for QUIC/HTTP3 connections. The vulnerability exists because libcurl's server certificate public key pinning feature fails to perform validation checks when connecting via QUIC for HTTP/3, despite documentation stating that pinning works with wolfSSL. This omission allows attackers to potentially conduct man-in-the-middle attacks against applications that rely on certificate pinning for security.

Critical Impact

Applications using libcurl with wolfSSL for HTTP/3 connections may unknowingly connect to malicious servers, as certificate pinning protection is silently bypassed. Users expecting pinned certificate validation could be vulnerable to impersonation attacks without any warning or error indication.

Affected Products

• Haxx curl (all versions using wolfSSL with QUIC/HTTP3)

Discovery Timeline

• May 28, 2025 - CVE-2025-5025 published to NVD
• July 30, 2025 - Last updated in NVD database

Technical Details for CVE-2025-5025

Vulnerability Analysis

This vulnerability is classified as CWE-295 (Improper Certificate Validation). The core issue stems from an implementation oversight in libcurl's certificate pinning mechanism when operating with the wolfSSL TLS backend in QUIC/HTTP3 mode.

Certificate pinning is a security technique that associates a host with its expected public key or certificate. When properly implemented, this prevents man-in-the-middle attacks even if an attacker possesses a valid certificate signed by a trusted certificate authority. However, in the affected configuration, libcurl fails to perform this critical validation step.

The vulnerability is particularly insidious because the transfer succeeds when the expected pin would match—giving no indication that the pinning check was never performed. Users who have configured pinning for security-sensitive applications may have a false sense of security while their connections remain vulnerable to interception.

Root Cause

The root cause is an implementation omission in libcurl's QUIC connection handling code when using wolfSSL as the TLS backend. While the certificate pinning option (CURLOPT_PINNEDPUBLICKEY) is correctly implemented for traditional HTTPS connections with wolfSSL, the code path for QUIC-based HTTP/3 connections does not invoke the pinning verification routines.

The documentation for libcurl stated that certificate pinning works with wolfSSL without specifying this critical exception for QUIC/HTTP3 connections. This documentation gap meant developers could reasonably expect their pinning configurations to be enforced across all connection types.

Attack Vector

The attack vector for CVE-2025-5025 is network-based, requiring an attacker to be in a position to intercept network traffic between the client and the intended server. An exploitation scenario would proceed as follows:

1. An attacker positions themselves to intercept network traffic (e.g., through ARP spoofing, DNS poisoning, or compromised network infrastructure)
2. The victim application initiates an HTTP/3 connection using libcurl with wolfSSL and certificate pinning configured
3. The attacker presents their own certificate, which would normally be rejected by the pinning check
4. Due to the vulnerability, libcurl does not perform the pinning validation for QUIC connections
5. The connection proceeds successfully, allowing the attacker to intercept, modify, or inject data

The attack complexity is high because it requires the attacker to be in a network position to perform interception, and the target must be specifically using libcurl with wolfSSL for HTTP/3 connections while relying on certificate pinning.

Detection Methods for CVE-2025-5025

Indicators of Compromise

• Unexpected HTTP/3 connections to servers with certificate information that doesn't match configured pins
• Network traffic showing QUIC connections to IP addresses that don't correspond to legitimate server infrastructure
• Application logs indicating successful connections where certificate warnings might be expected
• Anomalous SSL/TLS certificate chains observed during QUIC handshakes

Detection Strategies

• Monitor for applications using libcurl with wolfSSL and HTTP/3 enabled in environments where certificate pinning is a security requirement
• Implement network-level certificate transparency monitoring to detect unexpected certificates
• Deploy endpoint detection to identify libcurl library versions vulnerable to this issue
• Audit application configurations for reliance on CURLOPT_PINNEDPUBLICKEY with HTTP/3 enabled

Monitoring Recommendations

• Review application dependencies to identify use of affected libcurl configurations with wolfSSL
• Implement logging for HTTP/3 connections in security-sensitive applications
• Monitor for unusual network patterns that could indicate man-in-the-middle positioning
• Enable SentinelOne's network detection capabilities to identify anomalous QUIC traffic patterns

How to Mitigate CVE-2025-5025

Immediate Actions Required

• Upgrade to a patched version of libcurl that properly enforces certificate pinning for QUIC/HTTP3 with wolfSSL
• If upgrade is not immediately possible, disable HTTP/3 (QUIC) for connections where certificate pinning is required
• Audit applications to identify those relying on certificate pinning with wolfSSL and HTTP/3
• Consider temporarily switching to an alternative TLS backend that properly enforces pinning for QUIC connections

Patch Information

Haxx has released security advisories addressing this vulnerability. Detailed patch information and updated versions are available through the curl.se CVE-2025-5025 Documentation. The vulnerability was also reported through the HackerOne bug bounty program and discussed on the Openwall OSS-Security mailing list.

Organizations should update to the latest version of curl/libcurl that includes the fix for this vulnerability. Check your distribution's package repositories for security updates.

Workarounds

• Disable HTTP/3 support by setting CURLOPT_HTTP_VERSION to exclude HTTP/3 when certificate pinning is critical
• Use an alternative TLS backend such as OpenSSL where QUIC pinning is properly implemented
• Implement additional application-level certificate validation as a defense-in-depth measure
• Configure network security controls to limit exposure to potential man-in-the-middle attacks

# Configuration example - Disable HTTP/3 to prevent bypass
# In applications using libcurl, set the HTTP version option to exclude HTTP/3:
# curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2TLS);

# For command-line curl, avoid using --http3 flag when pinning is required:
curl --pinnedpubkey "sha256//hash=" https://example.com
# Instead of:
# curl --http3 --pinnedpubkey "sha256//hash=" https://example.com