CVE-2025-13034 describes a vulnerability in curl where the CURLOPT_PINNEDPUBLICKEY option or the --pinnedpubkey tool option fails to verify the server's public key under a specific condition. This condition requires the connection to be made using QUIC with ngtcp2 linked against GnuTLS and the user explicitly disabling standard certificate verification. Under these circumstances, curl skips the public key check, allowing connections to potentially an impostor server. The vulnerability was discovered by Stanislav Fort and affects several Ubuntu curl package versions. The issue is fixed in updated Ubuntu packages as per the Ubuntu security notice USN-8062-1.

The vulnerability allows an attacker to bypass the pinned public key verification in curl, potentially enabling a man-in-the-middle attack if the user disables standard certificate verification and uses QUIC with ngtcp2 built with GnuTLS. This could lead to unauthorized interception or manipulation of data transmitted over the affected curl connections. The impact is limited by the requirement that the user must explicitly disable certificate verification and use a specific transport configuration.

An official patch is available and should be applied by updating curl to the fixed versions provided by Ubuntu in security notice USN-8062-1. Users should avoid disabling standard certificate verification, especially when using QUIC with ngtcp2 and GnuTLS. Applying the vendor-provided updates will correct the issue and restore proper pinned public key verification.