---
schema_version: '1.0'
id: security-20260705-16b450
url: https://osv.dev/vulnerability/CVE-2025-13034
url_hash: 16b45061fbc25e86f403a86d4bdd7767041da43d63bee281232e3b8ae1ff163e
canonical_url: https://osv.dev/vulnerability/CVE-2025-13034
source: osv:nvd
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2025-13034
- severity:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- https://github.com/curl/curl
- GIT
lang: en
published_at: '2026-01-08T10:15:45Z'
fetched_at: '2026-07-05T15:34:34Z'
updated_at: '2026-07-08T15:37:32Z'
status: published
content_hash: 6b461e51281b62ffa72642b3e30384eeadaa4730594d5ab79e035fd33ee32a3a
license_note: full
summary: No QUIC certificate pinning with GnuTLS
summary_source: rss
summary_en: No QUIC certificate pinning with GnuTLS
entities:
- name: CVE-2013-0074
  type: naturalobject
- name: GitHub
  type: organization
- name: Quickhand
  type: organization
- name: aligned with
  type: UNKNOWN
related_auto:
- name: agent_openclaw
  type: person
  weight: 1.0
- name: CVSS score
  type: concept
  weight: 1.0
- name: AI Agent
  type: artifact
  weight: 1.0
- name: Hy3
  type: artifact
  weight: 1.0
- name: OpenClaw
  type: artifact
  weight: 1.0
title: CVE-2025-13034 — https://github.com/curl/curl
---

# CVE-2025-13034: No QUIC certificate pinning with GnuTLS

## TL;DR
No QUIC certificate pinning with GnuTLS

## Key Points
- cve / CVE-2025-13034 / severity:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N / https://github.com/curl/curl / GIT

## Details
**Severity:** CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
**Advisory:** CVE-2025-13034

**Affected (your watchlist):**
- `GIT:https://github.com/curl/curl` curl-8_9_1 → no fixed version listed [mac]

**Details:**
When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`
with the curl tool,curl should check the public key of the server certificate
to verify the peer.

This check was skipped in a certain condition that would then make curl allow
the connection without performing the proper check, thus not noticing a
possible impostor. To skip this check, the connection had to be done with QUIC
with ngtcp2 built to use GnuTLS and the user had to explicitly disable the
standard certificate verification.

**References:**
- https://curl.se/docs/CVE-2025-13034.html
- https://curl.se/docs/CVE-2025-13034.json
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13034.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-13034

_Data: OSV.dev (upstream: nvd) — https://osv.dev/vulnerability/CVE-2025-13034_

## Source
元記事: [CVE-2025-13034: No QUIC certificate pinning with GnuTLS](https://osv.dev/vulnerability/CVE-2025-13034) — published 2026-01-08T10:15:45Z