CVE-2026-87866
wolfSSL public-key pinning bypass
Project curl Security Advisory, October 14 2026 Permalink
VULNERABILITY
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
INFO
This flaw only exists when curl was built to use wolfSSL. This flaw also relies on a wolfSSL bug accepting this malformed certificate.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-87866 to this issue.
CWE-295: Improper Certificate Validation
Severity: Low
AFFECTED VERSIONS
- Affected versions: curl 7.43.0 to and including 8.22.0
- Not affected versions: curl < 7.43.0 and >= 8.23.0
- Not affected versions: curl >= 8.20.2 in the 8.20.X branch
- Not affected versions: curl >= 8.16.2 in the 8.16.X branch
- Not affected versions: curl >= 8.14.3 in the 8.14.X branch
- Introduced-in: https://github.com/curl/curl/commit/0675abbc7572ff6d711a1f3
libcurl is used by many applications, but not always advertised as such!
This flaw does not affect the curl command line tool.
SOLUTION
RECOMMENDATIONS
A - Upgrade curl to version 8.23.0
B - Apply the patch to your local version
C - Avoid key pinning or use another TLS backend
TIMELINE
This issue was reported to the curl project on September 2, 2026.
curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.
CREDITS
- Reported-by: Muhamad Arga Reksapati
- Patched-by: Stefan Eissing
Thanks a lot!