CVE-2026-80230
OpenSSL pinning bypass
Project curl Security Advisory, September 2 2026 Permalink
VULNERABILITY
When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on connections established without a presented
server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.
INFO
This flaw is present when libcurl is built to use OpenSSL or one of its many forks (BoringSSL, AWS-LC, LibreSSL, QuicTLS, etc).
In order to accept a situation where no certificate can be legit, the user most likely must also have weakened security by allowing a setup that is not allowed by OpenSSL by default.
This bug is not considered a C mistake (likely to have been avoided had we not been using C).
This flaw also affects the curl command line tool.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-80230 to this issue.
CWE-295: Improper Certificate Validation
Severity: low
AFFECTED VERSIONS
- Affected versions: curl 7.45.0 to and including 8.21.0
- Not affected versions: curl < 7.45.0 and >= 8.22.0
- Introduced-in: https://github.com/curl/curl/8363656cb4e0c60a11d8531
SOLUTION
RECOMMENDATIONS
We suggest you take one of the following actions immediately, in order of preference:
A - Upgrade curl and libcurl to version 8.22.0
B - Apply the patch to your version and rebuild
TIMELINE
This issue was reported to the curl project on August 24, 2026.
curl 8.22.0 was released on September 2 2026, coordinated with the publication of this advisory.
CREDITS
- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Daniel Stenberg
Thanks a lot!