CVE-2013-6422: The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT...

Security readout for executives and security teams

This flaw affects libcurl when built with GnuTLS and configured to turn off certificate peer verification. In affected versions, that setting also stopped host-name checking, allowing a network attacker to impersonate the intended HTTPS server. The business risk is fraudulent trusted connections, data interception, or traffic redirection in legacy systems using this unsafe configuration. Exposure is most likely in legacy systems using libcurl 7.21.4 through 7.33.0 with the GnuTLS backend and applications that disable CURLOPT_SSL_VERIFYPEER. Systems using other TLS backends or keeping peer verification enabled are not shown as affected by the provided sources. Treat this as a targeted legacy exposure issue, not a broad current internet emergency. Prioritize systems that still use old libcurl/GnuTLS combinations for sensitive HTTPS communication, especially where certificate verification was intentionally disabled. Mitigation focus: Identify applications and packages using affected libcurl versions with the GnuTLS backend.; Update libcurl packages according to curl, Debian, Ubuntu, HP, or Oracle advisories.; Avoid disabling CURLOPT_SSL_VERIFYPEER unless vendor guidance explicitly requires it..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.