curl: Public-key pinning bypass in wolfSSL builds

Summary

curl builds that use wolfSSL as TLS backend can accept a pinned public key hash that does not match the key the TLS peer actually holds. A malformed certificate with a manipulated validity length field makes curl's second parsing step extract a different embedded key. An attacker in a position to present such a certificate could bypass certificate pinning. The vendor rates the issue as Low; the CVSS 9.1 score in the request has no confirmed NVD analysis.

Affected

• curl 7.43.0 up to and including 8.22.0, only when built with wolfSSL
• Not affected: curl before 7.43.0, curl 8.23.0 and later, curl 8.20.2 and later in the 8.20.x branch, curl 8.16.2 and later in the 8.16.x branch, curl 8.14.3 and later in the 8.14.x branch
• curl builds with other TLS backends are not affected according to the advisory

Fixed in

• curl 8.23.0 (released October 14, 2026)
• Patch commit ed131747c1a3dc7f816d26724c44537ac8acba44
• Fixed wolfSSL version: Unknown.

Workaround

• Avoid public-key pinning in affected builds
• Use a curl build with another TLS backend, such as OpenSSL or GnuTLS
• Apply the vendor patch to a local build

Exploitation

• CISA SSVC lists exploitation as "poc" and automatable as yes.
• No evidence of in-the-wild exploitation was found.
• The vendor advisory does not state whether public proof-of-concept code exists; one aggregator reports no evidence of a public PoC.

Our recommendation

• Run "curl -V" on hosts and check whether the SSL library string shows wolfSSL.
• Upgrade affected curl builds to 8.23.0 or a fixed branch release.
• Check whether any software using libcurl pins public keys and review its configuration.
• Prioritise hosts that use custom, embedded or self-compiled curl builds, as typical distribution packages are often built with other TLS backends.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• curl security advisory CVE-2026-87866 curl.se
• curl CVE metadata JSON CVE-2026-87866 curl.se
• Original report on HackerOne hackerone.com
• OSV entry CURL-CVE-2026-87866 osv.dev
• Debian security tracker CVE-2026-87866 security-tracker.debian.org
• Ubuntu blog: curl vulnerabilities and fixes ubuntu.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:55.