---
schema_version: '1.0'
id: security-20260705-1ef7f7
url: https://osv.dev/vulnerability/CURL-CVE-2025-13034
url_hash: 1ef7f7a3a431976cc338c23b9a1cb6675b34f33b88ba550b012a915588a56957
canonical_url: https://osv.dev/vulnerability/CURL-CVE-2025-13034
source: osv:osv
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2025-13034
- CURL-CVE-2025-13034
- severity:Medium
- https://github.com/curl/curl
- GIT
lang: en
published_at: '2026-01-07T08:00:00Z'
fetched_at: '2026-07-05T15:34:34Z'
updated_at: '2026-07-05T15:37:03Z'
status: published
content_hash: 2cc5ce0e668db66f20a71ed8066ecdce9ffb12a603fa47fcfa809f5905485b66
license_note: full
summary: No QUIC certificate pinning with GnuTLS
summary_source: rss
summary_en: No QUIC certificate pinning with GnuTLS
entities:
- name: GitHub
  type: organization
- name: converge with
  type: UNKNOWN
key_facts: []
related: []
related_auto:
- name: Anonymous
  type: organization
  weight: 1.0
- name: AirPods
  type: artifact
  weight: 1.0
- name: Claude Code
  type: artifact
  weight: 1.0
- name: セッション漏洩
  type: event
  weight: 1.0
- name: local-llm
  type: content
  weight: 1.0
title: 'CVE-2025-13034: No QUIC certificate pinning with GnuTLS'
---

# CVE-2025-13034: No QUIC certificate pinning with GnuTLS

## TL;DR
No QUIC certificate pinning with GnuTLS

## Key Points
- cve / CVE-2025-13034 / CURL-CVE-2025-13034 / severity:Medium / https://github.com/curl/curl / GIT

## Details
**Severity:** Medium
**Advisory:** CURL-CVE-2025-13034 (CVE-2025-13034)

**Affected (your watchlist):**
- `GIT:https://github.com/curl/curl` curl-8_9_1 → no fixed version listed [mac]

**Details:**
When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`
with the curl tool, curl should check the public key of the server certificate
to verify the peer.

This check was skipped in a certain condition that would then make curl allow
the connection without performing the proper check, thus not noticing a
possible impostor. To skip this check, the connection had to be done with QUIC
with ngtcp2 built to use GnuTLS and the user had to explicitly disable the
standard certificate verification.

_Data: OSV.dev (upstream: osv) — https://osv.dev/vulnerability/CURL-CVE-2025-13034_

## Source
元記事: [CVE-2025-13034: No QUIC certificate pinning with GnuTLS](https://osv.dev/vulnerability/CURL-CVE-2025-13034) — published 2026-01-07T08:00:00Z