CVE-2026-87866
curl curl
- curl curl
- Critical
- CVSS 9.1
- EPSS 0.21%
- No fixed version listed here
Summary
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess.
From the CVE record.
Read the original description
CVE record
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
What to do
No fixed version listed here
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| curl curl | from 8.22.0 through 8.22.0; from 8.21.0 through 8.21.0; from 8.20.0 through 8.20.0; from 8.19.0 through 8.19.0; from 8.18.0 through 8.18.0; from 8.17.0 through 8.17.0; from 8.16.0 through 8.16.0; from 8.15.0 through 8.15.0; from 8.14.1 through 8.14.1; from 8.14.0 through 8.14.0; from 8.13.0 through 8.13.0; from 8.12.1 through 8.12.1; from 8.12.0 through 8.12.0; from 8.11.1 through 8.11.1; from 8.11.0 through 8.11.0; from 8.10.1 through 8.10.1; from 8.10.0 through 8.10.0; from 8.9.1 through 8.9.1; from 8.9.0 through 8.9.0; from 8.8.0 through 8.8.0; from 8.7.1 through 8.7.1; from 8.7.0 through 8.7.0; from 8.6.0 through 8.6.0; from 8.5.0 through 8.5.0; from 8.4.0 through 8.4.0; from 8.3.0 through 8.3.0; from 8.2.1 through 8.2.1; from 8.2.0 through 8.2.0; from 8.1.2 through 8.1.2; from 8.1.1 through 8.1.1 | Only in the CVE record |
The CVE record lists 70 ranges this page cannot state exactly.
Advisories and fixes
- Public exploit hackerone.com
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.1 (v3.1, scored by CISA-ADP)
- EPSS
- 0.21% chance of exploitation in the next 30 days (EPSS from FIRST, as of Oct 29, 2026)
- CISA's SSVC decision points
- Exploitation: proof of concept. Automatable: yes. Technical impact: total. As of Oct 29, 2026.
- Weakness
- CWE-295: Improper Certificate Validation
- Vendor
- curl, curl
Timeline
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.