QUIC certificate check skip with wolfSSL

{
  "id": "8ef02bb47ae2b241f66a13e2418094474dade8219359396e5ded9df27a46bee6",
  "url": "https://osv.dev/vulnerability/CURL-CVE-2025-4947",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "QUIC certificate check skip with wolfSSL",
    "summary": "libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.",
    "evidence": "osv:CURL-CVE-2025-4947",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CURL-CVE-2025-4947",
      "aliases": [
        "CURL-CVE-2025-4947",
        "CVE-2025-4947"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "8.8.0"
                },
                {
                  "fixed": "8.14.0"
                }
              ]
            },
            {
              "repo": "https://github.com/curl/curl.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "4c46e277b2a0c0489de0e0fcb91f315c62f0369c"
                },
                {
                  "fixed": "a85f1df4803bbd272905c9e712537b41afeafbd3"
                }
              ]
            }
          ],
          "versions": [
            "8.13.0",
            "8.12.1",
            "8.12.0",
            "8.11.1",
            "8.11.0",
            "8.10.1",
            "8.10.0",
            "8.9.1",
            "8.9.0",
            "8.8.0",
            "curl-8_13_0",
            "curl-8_12_1",
            "curl-8_12_0",
            "curl-8_11_1",
            "curl-8_11_0",
            "curl-8_10_1",
            "curl-8_10_0",
            "curl-8_9_1",
            "curl-8_9_0",
            "curl-8_8_0"
          ],
          "database_specific": {
            "source": "https://curl.se/docs/CURL-CVE-2025-4947.json",
            "vanir_signatures": [
              {
                "id": "CURL-CVE-2025-4947-43902428",
                "digest": {
                  "threshold": 0.9,
                  "line_hashes": [
                    "80211781897125907216617466032987610984",
                    "68890303834346341213727486246797762367",
                    "52142079782883376964682183668234246364",
                    "68749118774670511271813411320118219036",
                    "257651649534267240063617473881008983603",
                    "72459915854897445456226013568529407607",
                    "246962167824758465144668491832284230541",
                    "148486550461138867129576406502765894046",
                    "47205215324501448097833419745667265918",
                    "97386622391566701874344023816512674624",
                    "265537291877676368672848132467158892736"
                  ]
                },
                "source": "https://github.com/curl/curl.git/commit/a85f1df4803bbd272905c9e712537b41afeafbd3",
                "target": {
                  "file": "lib/vquic/vquic-tls.c"
                },
                "deprecated": false,
                "signature_type": "Line",
                "signature_version": "v1"
              },
              {
                "id": "CURL-CVE-2025-4947-74a0efb0",
                "digest": {
                  "length": 963,
                  "function_hash": "56537916447733253337736822579741998455"
                },
                "source": "https://github.com/curl/curl.git/commit/a85f1df4803bbd272905c9e712537b41afeafbd3",
                "target": {
                  "file": "lib/vquic/vquic-tls.c",
                  "function": "Curl_vquic_tls_verify_peer"
                },
                "deprecated": false,
                "signature_type": "Function",
                "signature_version": "v1"
              }
            ],
            "vanir_signatures_modified": "2026-10-25T01:05:40Z"
          }
        }
      ],
      "modified": "2026-10-25T01:05:40.942983026Z",
      "provider": "osv",
      "references": [],
      "provider_metadata": {
        "CWE": {
          "id": "CWE-295",
          "desc": "Improper Certificate Validation"
        },
        "URL": "https://curl.se/docs/CVE-2025-4947.json",
        "www": "https://curl.se/docs/CVE-2025-4947.html",
        "award": {
          "amount": "2540",
          "currency": "USD"
        },
        "issue": "https://hackerone.com/reports/3150884",
        "affects": "both",
        "package": "curl",
        "severity": "Medium",
        "last_affected": "8.13.0"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-4947",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 444417,
  "published_at": "2025-05-28T08:00:00+00:00"
}