# CVE-2025-13034: curl certificate pinning bypass in QUIC with GnuTLS

Source: https://junglewise.ai/threats/cve-2025-13034-curl-certificate-pinning-bypass-in-quic-with-gnutls  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-13034 · Severity: medium · CVSS 5.9 · Published 2026-01-08

curl is a widely-used tool and library for downloading files and making web requests. When configured to pin specific server certificates for security (using the CURLOPT_PINNEDPUBLICKEY option), curl should reject any server presenting a different certificate. However, under specific conditions—using the QUIC protocol with GnuTLS and when certificate verification is disabled—this pinning check is skipped, allowing an attacker to perform a man-in-the-middle attack and impersonate the intended server.

Technologies: [Haxx Curl](https://junglewise.ai/threats/technologies/curl). Vendors: [Haxx](https://junglewise.ai/threats/vendors/haxx).

## Quick answers

**Is CVE-2025-13034 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-13034 being exploited in the wild.

**How severe is CVE-2025-13034?** Medium severity, with a CVSS score of 5.9, published 8 January 2026.

**Which products and versions are affected?** curl curl 8.8.0 to 8.17.0 (multiple branches patched at 8.14.2, 8.16.1, and 8.18.0).

**Is there a fix for CVE-2025-13034?** A patch was published on 2026-01-07: curl 8.18.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-13034 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-13034?** Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an improper certificate validation vulnerability (CWE-295) affecting curl's QUIC/HTTP3 implementation when using ngtcp2 with GnuTLS as the TLS backend. When a user sets the CURLOPT_PINNEDPUBLICKEY option (or --pinnedpubkey flag) to pin a server's public key, curl should validate the server certificate against the pinned key before allowing the connection. The vulnerability exists because this validation is skipped when all three conditions are met: (1) QUIC protocol is used, (2) ngtcp2 backend is built with GnuTLS, and (3) standard certificate verification has been explicitly disabled. The attack vector is network-based and requires no user interaction beyond establishing the connection. An attacker in a network position to intercept traffic can present an alternative certificate and be accepted as the legitimate server. Patches are available in curl 8.14.2, 8.16.1, and 8.18.0; versions prior to 8.8.0 are unaffected.

## Affected products

- curl curl 8.8.0 to 8.17.0 (multiple branches patched at 8.14.2, 8.16.1, and 8.18.0)

## Timeline

- 2026-01-07: disclosed: Security advisory published by curl project
- 2026-01-07: patched: curl 8.18.0 released with fix
- 2025-11-09: other: Vulnerability reported to curl project by Stanislav Fort (Aisle Research)

## References

- [https://curl.se/docs/CVE-2025-13034.html](https://curl.se/docs/CVE-2025-13034.html)
- [https://curl.se/docs/CVE-2025-13034.json](https://curl.se/docs/CVE-2025-13034.json)

## Related threats

- [curl Public Suffix List domain boundary check bypass in cookie handling](https://junglewise.ai/threats/cve-2026-82209-curl-public-suffix-list-domain-boundary-check-bypass-in-cookie)
- [curl libcurl certificate validation bypass in wolfSSL backend](https://junglewise.ai/threats/cve-2026-82208-curl-libcurl-certificate-validation-bypass-in-wolfssl-backend)
- [curl secure cookie attribute bypass with tab](https://junglewise.ai/threats/cve-2026-80255-curl-secure-cookie-attribute-bypass-with-tab)
- [curl HTTPS connection reuse with mismatched CA store settings](https://junglewise.ai/threats/cve-2026-80231-curl-https-connection-reuse-with-mismatched-ca-store-settings)
- [curl public key pinning bypass with disabled peer verification](https://junglewise.ai/threats/cve-2026-80230-curl-public-key-pinning-bypass-with-disabled-peer-verification)