CVE-2025-4947: curl · Improper Certificate Validation
Affects curlSource CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 09:15 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 22% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 28 May 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| curl curl | Affected
| Fixed in– |
AI-suggested
Organizations should immediately audit their use of curl, especially scripts and applications that initiate QUIC connections using IP addresses in URLs. Where possible, replace IP addresses with fully qualified domain names (FQDNs) to ensure proper certificate validation. Update curl to the latest patched version once available from the vendor to address the certificate validation bypass. In the interim, consider disabling QUIC protocol support in curl if feasible to avoid exposure. Network-level mitigations such as enforcing TLS inspection and monitoring for anomalous QUIC traffic may help detect exploitation attempts. Additionally, implement strict certificate pinning or mutual TLS authentication for critical services to reduce reliance on default validation. Security teams should review logs for unusual QUIC connection patterns and prepare incident response plans for potential MITM scenarios. Finally, educate developers and system administrators about the risks of using IP addresses in secure connections and encourage best practices for secure communication.
Description
libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.