CVE-2026-87866None▾ SunlitWhen built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certif…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
0.2% → 0.2%
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
curl >= 8.22.0 <= 8.22.0curl >= 8.21.0 <= 8.21.0curl >= 8.20.0 <= 8.20.0curl >= 8.19.0 <= 8.19.0curl >= 8.18.0 <= 8.18.0curl >= 8.17.0 <= 8.17.0curl >= 8.16.0 <= 8.16.0curl >= 8.15.0 <= 8.15.0curl >= 8.14.1 <= 8.14.1curl >= 8.14.0 <= 8.14.0curl >= 8.13.0 <= 8.13.0curl >= 8.12.1 <= 8.12.1curl >= 8.12.0 <= 8.12.0curl >= 8.11.1 <= 8.11.1curl >= 8.11.0 <= 8.11.0curl >= 8.10.1 <= 8.10.1curl >= 8.10.0 <= 8.10.0curl >= 8.9.1 <= 8.9.1curl >= 8.9.0 <= 8.9.0curl >= 8.8.0 <= 8.8.0curl >= 8.7.1 <= 8.7.1curl >= 8.7.0 <= 8.7.0curl >= 8.6.0 <= 8.6.0curl >= 8.5.0 <= 8.5.0curl >= 8.4.0 <= 8.4.0curl >= 8.3.0 <= 8.3.0curl >= 8.2.1 <= 8.2.1curl >= 8.2.0 <= 8.2.0curl >= 8.1.2 <= 8.1.2curl >= 8.1.1 <= 8.1.1curl >= 8.1.0 <= 8.1.0curl >= 8.0.1 <= 8.0.1curl >= 8.0.0 <= 8.0.0curl >= 7.88.1 <= 7.88.1curl >= 7.88.0 <= 7.88.0curl >= 7.87.0 <= 7.87.0curl >= 7.86.0 <= 7.86.0curl >= 7.85.0 <= 7.85.0curl >= 7.84.0 <= 7.84.0curl >= 7.83.1 <= 7.83.1curl >= 7.83.0 <= 7.83.0curl >= 7.82.0 <= 7.82.0curl >= 7.81.0 <= 7.81.0curl >= 7.80.0 <= 7.80.0curl >= 7.79.1 <= 7.79.1curl >= 7.79.0 <= 7.79.0curl >= 7.78.0 <= 7.78.0curl >= 7.77.0 <= 7.77.0curl >= 7.76.1 <= 7.76.1curl >= 7.76.0 <= 7.76.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-87865Noneknownhost callback mismatches key as missing
CVE-2024-8096Medium· 6.5When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the respon…
CVE-2024-2379Medium· 6.3libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL
CVE-2022-27782High· 7.5libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse i…
CVE-2021-22926High· 7.5libcurl-using applications can ask for a specific client certificate to be used in a transfer
CVE-2026-4873Medium· 5.9A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool