Executive brief
curl is a widely-used tool and library for downloading files and making web requests. When configured to pin specific server certificates for security (using the CURLOPT_PINNEDPUBLICKEY option), curl should reject any server presenting a different certificate. However, under specific conditions—using the QUIC protocol with GnuTLS and when certificate verification is disabled—this pinning check is skipped, allowing an attacker to perform a man-in-the-middle attack and impersonate the intended server.
Technical details
This is an improper certificate validation vulnerability (CWE-295) affecting curl's QUIC/HTTP3 implementation when using ngtcp2 with GnuTLS as the TLS backend. When a user sets the CURLOPT_PINNEDPUBLICKEY option (or --pinnedpubkey flag) to pin a server's public key, curl should validate the server certificate against the pinned key before allowing the connection. The vulnerability exists because this validation is skipped when all three conditions are met: (1) QUIC protocol is used, (2) ngtcp2 backend is built with GnuTLS, and (3) standard certificate verification has been explicitly disabled. The attack vector is network-based and requires no user interaction beyond establishing the connection. An attacker in a network position to intercept traffic can present an alternative certificate and be accepted as the legitimate server. Patches are available in curl 8.14.2, 8.16.1, and 8.18.0; versions prior to 8.8.0 are unaffected.
Affected products
- curl curl 8.8.0 to 8.17.0 (multiple branches patched at 8.14.2, 8.16.1, and 8.18.0)
Timeline
- 2026-01-07: disclosed: Security advisory published by curl project
- 2026-01-07: patched: curl 8.18.0 released with fix
- 2025-11-09: other: Vulnerability reported to curl project by Stanislav Fort (Aisle Research)