CVE-2025-4947
Advisory lineage Upstream: 0 Downstream: 5
Analyzed
Published: 28 May 2025, 06:29
Last modified:28 May 2025, 13:58
Vulnerability Summary
Overall Risk (default)
medium
36/100 CVSS Score
6.5 MEDIUM
v3.1 (cve.org)
EPSS Score
0.24% LOW
0% probability +0.22%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected
Timeline
28 May 2025, 06:29
Published
Vulnerability first disclosed
28 May 2025, 13:58
Last Modified
Vulnerability information updated
Description
libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.
CVSS Metrics
- v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS Trends
Current EPSS score: 0.24%• Percentile: 15%
Techniques & Countermeasures
- CWE-295•Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Affected Systems
- curl•curl
8.13.0 | 8.12.1 | 8.12.0 | 8.11.1 | 8.11.0 | 8.10.1 | 8.10.0 | 8.9.1 | 8.9.0 | 8.8.0
- haxx•curl
≥ 8.8.0, < 8.14.0