Fluid Attacks Database

Description

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
alpine v3.19	curl	>=8.8.0 <8.14.0-r0	8.14.0-r0
debian 13	curl	>=0 <8.14.0-1	8.14.0-1
debian 14	curl	>=0 <8.14.0-1	8.14.0-1
alpine v3.20	curl	>=8.8.0 <8.14.0-r0	8.14.0-r0
alpine v3.21	curl	>=8.8.0 <8.14.0-r0	8.14.0-r0
alpine v3.22	curl	>=8.8.0 <8.14.0-r0	8.14.0-r0
alpine v3.23	curl	>=8.8.0 <8.14.0-r0	8.14.0-r0
alpine v3.24	curl	>=8.8.0 <8.14.0-r0	8.14.0-r0

Aliases

1. CVE-2025-49472. NVD-2025-49473. OSV-ALPINE-2025-49474. OSV-2025-49475. OSV-DEBIAN-2025-49476. SECURITY-CVE-2025-49477. SECURITY-TRACKER-CVE-2025-4947

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.