{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-08T00:31:03.406","vulnerabilities":[{"cve":{"id":"CVE-2025-13034","sourceIdentifier":"2499f714-1537-4658-8207-48ae4bb9eae9","published":"2026-01-08T10:15:45.407","lastModified":"2026-01-20T14:54:02.730","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool,curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification."},{"lang":"es","value":"Al usar la opción 'CURLOPT_PINNEDPUBLICKEY' con libcurl o '--pinnedpubkey' con la herramienta curl, curl debería verificar la clave pública del certificado del servidor para verificar el par.\n\nEsta verificación se omitió en una determinada condición que luego haría que curl permitiera la conexión sin realizar la verificación adecuada, sin notar así un posible impostor. Para omitir esta verificación, la conexión tenía que hacerse con QUIC con ngtcp2 compilado para usar GnuTLS y el usuario tenía que deshabilitar explícitamente la verificación estándar del certificado."}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*","versionStartIncluding":"8.8.0","versionEndExcluding":"8.18.0","matchCriteriaId":"E6152C75-3784-4E17-A770-4585D1FD80C4"}]}]}],"references":[{"url":"https://curl.se/docs/CVE-2025-13034.html","source":"2499f714-1537-4658-8207-48ae4bb9eae9","tags":["Vendor Advisory","Patch"]},{"url":"https://curl.se/docs/CVE-2025-13034.json","source":"2499f714-1537-4658-8207-48ae4bb9eae9","tags":["Vendor Advisory"]}]}}]}