CVE-2026-80230

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80230", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "state": "PUBLISHED", "assignerShortName": "curl", "dateReserved": "2026-08-26T04:24:25.568Z", "datePublished": "2026-09-06T17:48:16.262Z", "dateUpdated": "2026-09-15T06:03:10.429Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-15T06:03:10.429Z"}, "title": "OpenSSL pinning bypass", "descriptions": [{"lang": "en", "value": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"version": "7.45.0", "status": "affected", "versionType": "semver", "lessThan": "8.14.2"}, {"version": "8.15.0", "status": "affected", "versionType": "semver", "lessThan": "8.16.1"}, {"version": "8.17.0", "status": "affected", "versionType": "semver", "lessThan": "8.20.1"}, {"version": "8.21.0", "status": "affected", "versionType": "semver", "lessThan": "8.22.0"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"version": "8363656cb4e0c60a11d8531ead0ec43120b50591", "status": "affected", "versionType": "git", "lessThan": "5267ed859d545534d0c21675a2b70af5a3b6e3ef"}], "defaultStatus": "unaffected", "repo": "https://github.com/curl/curl.git"}, {"vendor": "curl", "product": "curl", "versions": [{"version": "8.21.0", "status": "affected"}, {"version": "8.20.0", "status": "affected"}, {"version": "8.19.0", "status": "affected"}, {"version": "8.18.0", "status": "affected"}, {"version": "8.17.0", "status": "affected"}, {"version": "8.16.0", "status": "affected"}, {"version": "8.15.0", "status": "affected"}, {"version": "8.14.1", "status": "affected"}, {"version": "8.14.0", "status": "affected"}, {"version": "8.13.0", "status": "affected"}, {"version": "8.12.1", "status": "affected"}, {"version": "8.12.0", "status": "affected"}, {"version": "8.11.1", "status": "affected"}, {"version": "8.11.0", "status": "affected"}, {"version": "8.10.1", "status": "affected"}, {"version": "8.10.0", "status": "affected"}, {"version": "8.9.1", "status": "affected"}, {"version": "8.9.0", "status": "affected"}, {"version": "8.8.0", "status": "affected"}, {"version": "8.7.1", "status": "affected"}, {"version": "8.7.0", "status": "affected"}, {"version": "8.6.0", "status": "affected"}, {"version": "8.5.0", "status": "affected"}, {"version": "8.4.0", "status": "affected"}, {"version": "8.3.0", "status": "affected"}, {"version": "8.2.1", "status": "affected"}, {"version": "8.2.0", "status": "affected"}, {"version": "8.1.2", "status": "affected"}, {"version": "8.1.1", "status": "affected"}, {"version": "8.1.0", "status": "affected"}, {"version": "8.0.1", "status": "affected"}, {"version": "8.0.0", "status": "affected"}, {"version": "7.88.1", "status": "affected"}, {"version": "7.88.0", "status": "affected"}, {"version": "7.87.0", "status": "affected"}, {"version": "7.86.0", "status": "affected"}, {"version": "7.85.0", "status": "affected"}, {"version": "7.84.0", "status": "affected"}, {"version": "7.83.1", "status": "affected"}, {"version": "7.83.0", "status": "affected"}, {"version": "7.82.0", "status": "affected"}, {"version": "7.81.0", "status": "affected"}, {"version": "7.80.0", "status": "affected"}, {"version": "7.79.1", "status": "affected"}, {"version": "7.79.0", "status": "affected"}, {"version": "7.78.0", "status": "affected"}, {"version": "7.77.0", "status": "affected"}, {"version": "7.76.1", "status": "affected"}, {"version": "7.76.0", "status": "affected"}, {"version": "7.75.0", "status": "affected"}, {"version": "7.74.0", "status": "affected"}, {"version": "7.73.0", "status": "affected"}, {"version": "7.72.0", "status": "affected"}, {"version": "7.71.1", "status": "affected"}, {"version": "7.71.0", "status": "affected"}, {"version": "7.70.0", "status": "affected"}, {"version": "7.69.1", "status": "affected"}, {"version": "7.69.0", "status": "affected"}, {"version": "7.68.0", "status": "affected"}, {"version": "7.67.0", "status": "affected"}, {"version": "7.66.0", "status": "affected"}, {"version": "7.65.3", "status": "affected"}, {"version": "7.65.2", "status": "affected"}, {"version": "7.65.1", "status": "affected"}, {"version": "7.65.0", "status": "affected"}, {"version": "7.64.1", "status": "affected"}, {"version": "7.64.0", "status": "affected"}, {"version": "7.63.0", "status": "affected"}, {"version": "7.62.0", "status": "affected"}, {"version": "7.61.1", "status": "affected"}, {"version": "7.61.0", "status": "affected"}, {"version": "7.60.0", "status": "affected"}, {"version": "7.59.0", "status": "affected"}, {"version": "7.58.0", "status": "affected"}, {"version": "7.57.0", "status": "affected"}, {"version": "7.56.1", "status": "affected"}, {"version": "7.56.0", "status": "affected"}, {"version": "7.55.1", "status": "affected"}, {"version": "7.55.0", "status": "affected"}, {"version": "7.54.1", "status": "affected"}, {"version": "7.54.0", "status": "affected"}, {"version": "7.53.1", "status": "affected"}, {"version": "7.53.0", "status": "affected"}, {"version": "7.52.1", "status": "affected"}, {"version": "7.52.0", "status": "affected"}, {"version": "7.51.0", "status": "affected"}, {"version": "7.50.3", "status": "affected"}, {"version": "7.50.2", "status": "affected"}, {"version": "7.50.1", "status": "affected"}, {"version": "7.50.0", "status": "affected"}, {"version": "7.49.1", "status": "affected"}, {"version": "7.49.0", "status": "affected"}, {"version": "7.48.0", "status": "affected"}, {"version": "7.47.1", "status": "affected"}, {"version": "7.47.0", "status": "affected"}, {"version": "7.46.0", "status": "affected"}, {"version": "7.45.0", "status": "affected"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-80230.json"}, {"url": "https://curl.se/docs/CVE-2026-80230.html"}, {"url": "https://hackerone.com/reports/3969300"}], "x_osv": {"schema_version": "1.5.0", "id": "CURL-CVE-2026-80230", "aliases": ["CVE-2026-80230"], "summary": "OpenSSL pinning bypass", "modified": "2026-09-07T10:34:51.00Z", "database_specific": {"package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-80230.json", "www": "https://curl.se/docs/CVE-2026-80230.html", "issue": "https://hackerone.com/reports/3969300", "CWE": {"id": "CWE-295", "desc": "Improper Certificate Validation"}, "last_affected": "8.21.0", "severity": "Low"}, "published": "2026-09-02T08:00:00.00Z", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "7.45.0"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.20.1"}, {"introduced": "8.21.0"}, {"fixed": "8.22.0"}]}, {"type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [{"introduced": "8363656cb4e0c60a11d8531ead0ec43120b50591"}, {"fixed": "5267ed859d545534d0c21675a2b70af5a3b6e3ef"}]}], "versions": ["8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0"]}], "credits": [{"name": "Stanislav Fort (Aisle Research)", "type": "finder"}, {"name": "Daniel Stenberg", "type": "remediation developer"}], "details": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Certificate Validation", "cweId": "CWE-295", "type": "CWE"}]}], "credits": [{"lang": "en", "value": "Stanislav Fort (Aisle Research)", "type": "finder"}, {"lang": "en", "value": "Daniel Stenberg", "type": "remediation developer"}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-295", "lang": "en", "description": "CWE-295 Improper Certificate Validation"}]}], "references": [{"url": "https://hackerone.com/reports/3969300", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-08T18:51:52.168741Z", "id": "CVE-2026-80230", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-08T18:53:26.975Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-80230", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-08T18:51:52.168741Z"}}}], "references": [{"url": "https://hackerone.com/reports/3969300", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-08T18:53:14.829Z"}}], "cna": {"title": "OpenSSL pinning bypass", "x_osv": {"id": "CURL-CVE-2026-80230", "aliases": ["CVE-2026-80230"], "credits": [{"name": "Stanislav Fort (Aisle Research)", "type": "finder"}, {"name": "Daniel Stenberg", "type": "remediation developer"}], "details": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected.", "summary": "OpenSSL pinning bypass", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "7.45.0"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.20.1"}, {"introduced": "8.21.0"}, {"fixed": "8.22.0"}]}, {"repo": "https://github.com/curl/curl.git", "type": "GIT", "events": [{"introduced": "8363656cb4e0c60a11d8531ead0ec43120b50591"}, {"fixed": "5267ed859d545534d0c21675a2b70af5a3b6e3ef"}]}], "versions": ["8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0"]}], "modified": "2026-09-07T10:34:51.00Z", "published": "2026-09-02T08:00:00.00Z", "schema_version": "1.5.0", "database_specific": {"CWE": {"id": "CWE-295", "desc": "Improper Certificate Validation"}, "URL": "https://curl.se/docs/CVE-2026-80230.json", "www": "https://curl.se/docs/CVE-2026-80230.html", "issue": "https://hackerone.com/reports/3969300", "affects": "both", "package": "curl", "severity": "Low", "last_affected": "8.21.0"}}, "credits": [{"lang": "en", "type": "finder", "value": "Stanislav Fort (Aisle Research)"}, {"lang": "en", "type": "remediation developer", "value": "Daniel Stenberg"}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "7.45.0", "lessThan": "8.14.2", "versionType": "semver"}, {"status": "affected", "version": "8.15.0", "lessThan": "8.16.1", "versionType": "semver"}, {"status": "affected", "version": "8.17.0", "lessThan": "8.20.1", "versionType": "semver"}, {"status": "affected", "version": "8.21.0", "lessThan": "8.22.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"repo": "https://github.com/curl/curl.git", "vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8363656cb4e0c60a11d8531ead0ec43120b50591", "lessThan": "5267ed859d545534d0c21675a2b70af5a3b6e3ef", "versionType": "git"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.21.0"}, {"status": "affected", "version": "8.20.0"}, {"status": "affected", "version": "8.19.0"}, {"status": "affected", "version": "8.18.0"}, {"status": "affected", "version": "8.17.0"}, {"status": "affected", "version": "8.16.0"}, {"status": "affected", "version": "8.15.0"}, {"status": "affected", "version": "8.14.1"}, {"status": "affected", "version": "8.14.0"}, {"status": "affected", "version": "8.13.0"}, {"status": "affected", "version": "8.12.1"}, {"status": "affected", "version": "8.12.0"}, {"status": "affected", "version": "8.11.1"}, {"status": "affected", "version": "8.11.0"}, {"status": "affected", "version": "8.10.1"}, {"status": "affected", "version": "8.10.0"}, {"status": "affected", "version": "8.9.1"}, {"status": "affected", "version": "8.9.0"}, {"status": "affected", "version": "8.8.0"}, {"status": "affected", "version": "8.7.1"}, {"status": "affected", "version": "8.7.0"}, {"status": "affected", "version": "8.6.0"}, {"status": "affected", "version": "8.5.0"}, {"status": "affected", "version": "8.4.0"}, {"status": "affected", "version": "8.3.0"}, {"status": "affected", "version": "8.2.1"}, {"status": "affected", "version": "8.2.0"}, {"status": "affected", "version": "8.1.2"}, {"status": "affected", "version": "8.1.1"}, {"status": "affected", "version": "8.1.0"}, {"status": "affected", "version": "8.0.1"}, {"status": "affected", "version": "8.0.0"}, {"status": "affected", "version": "7.88.1"}, {"status": "affected", "version": "7.88.0"}, {"status": "affected", "version": "7.87.0"}, {"status": "affected", "version": "7.86.0"}, {"status": "affected", "version": "7.85.0"}, {"status": "affected", "version": "7.84.0"}, {"status": "affected", "version": "7.83.1"}, {"status": "affected", "version": "7.83.0"}, {"status": "affected", "version": "7.82.0"}, {"status": "affected", "version": "7.81.0"}, {"status": "affected", "version": "7.80.0"}, {"status": "affected", "version": "7.79.1"}, {"status": "affected", "version": "7.79.0"}, {"status": "affected", "version": "7.78.0"}, {"status": "affected", "version": "7.77.0"}, {"status": "affected", "version": "7.76.1"}, {"status": "affected", "version": "7.76.0"}, {"status": "affected", "version": "7.75.0"}, {"status": "affected", "version": "7.74.0"}, {"status": "affected", "version": "7.73.0"}, {"status": "affected", "version": "7.72.0"}, {"status": "affected", "version": "7.71.1"}, {"status": "affected", "version": "7.71.0"}, {"status": "affected", "version": "7.70.0"}, {"status": "affected", "version": "7.69.1"}, {"status": "affected", "version": "7.69.0"}, {"status": "affected", "version": "7.68.0"}, {"status": "affected", "version": "7.67.0"}, {"status": "affected", "version": "7.66.0"}, {"status": "affected", "version": "7.65.3"}, {"status": "affected", "version": "7.65.2"}, {"status": "affected", "version": "7.65.1"}, {"status": "affected", "version": "7.65.0"}, {"status": "affected", "version": "7.64.1"}, {"status": "affected", "version": "7.64.0"}, {"status": "affected", "version": "7.63.0"}, {"status": "affected", "version": "7.62.0"}, {"status": "affected", "version": "7.61.1"}, {"status": "affected", "version": "7.61.0"}, {"status": "affected", "version": "7.60.0"}, {"status": "affected", "version": "7.59.0"}, {"status": "affected", "version": "7.58.0"}, {"status": "affected", "version": "7.57.0"}, {"status": "affected", "version": "7.56.1"}, {"status": "affected", "version": "7.56.0"}, {"status": "affected", "version": "7.55.1"}, {"status": "affected", "version": "7.55.0"}, {"status": "affected", "version": "7.54.1"}, {"status": "affected", "version": "7.54.0"}, {"status": "affected", "version": "7.53.1"}, {"status": "affected", "version": "7.53.0"}, {"status": "affected", "version": "7.52.1"}, {"status": "affected", "version": "7.52.0"}, {"status": "affected", "version": "7.51.0"}, {"status": "affected", "version": "7.50.3"}, {"status": "affected", "version": "7.50.2"}, {"status": "affected", "version": "7.50.1"}, {"status": "affected", "version": "7.50.0"}, {"status": "affected", "version": "7.49.1"}, {"status": "affected", "version": "7.49.0"}, {"status": "affected", "version": "7.48.0"}, {"status": "affected", "version": "7.47.1"}, {"status": "affected", "version": "7.47.0"}, {"status": "affected", "version": "7.46.0"}, {"status": "affected", "version": "7.45.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-80230.json"}, {"url": "https://curl.se/docs/CVE-2026-80230.html"}, {"url": "https://hackerone.com/reports/3969300"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-15T06:03:10.429Z"}}}, "cveMetadata": {"cveId": "CVE-2026-80230", "state": "PUBLISHED", "dateUpdated": "2026-09-15T06:03:10.429Z", "dateReserved": "2026-08-26T04:24:25.568Z", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "datePublished": "2026-09-06T17:48:16.262Z", "assignerShortName": "curl"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"lessThan": "8.14.2", "status": "affected", "version": "7.45.0", "versionType": "semver"}, {"lessThan": "8.16.1", "status": "affected", "version": "8.15.0", "versionType": "semver"}, {"lessThan": "8.20.1", "status": "affected", "version": "8.17.0", "versionType": "semver"}, {"lessThan": "8.22.0", "status": "affected", "version": "8.21.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "curl", "repo": "https://github.com/curl/curl.git", "vendor": "curl", "versions": [{"lessThan": "5267ed859d545534d0c21675a2b70af5a3b6e3ef", "status": "affected", "version": "8363656cb4e0c60a11d8531ead0ec43120b50591", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"status": "affected", "version": "8.21.0"}, {"status": "affected", "version": "8.20.0"}, {"status": "affected", "version": "8.19.0"}, {"status": "affected", "version": "8.18.0"}, {"status": "affected", "version": "8.17.0"}, {"status": "affected", "version": "8.16.0"}, {"status": "affected", "version": "8.15.0"}, {"status": "affected", "version": "8.14.1"}, {"status": "affected", "version": "8.14.0"}, {"status": "affected", "version": "8.13.0"}, {"status": "affected", "version": "8.12.1"}, {"status": "affected", "version": "8.12.0"}, {"status": "affected", "version": "8.11.1"}, {"status": "affected", "version": "8.11.0"}, {"status": "affected", "version": "8.10.1"}, {"status": "affected", "version": "8.10.0"}, {"status": "affected", "version": "8.9.1"}, {"status": "affected", "version": "8.9.0"}, {"status": "affected", "version": "8.8.0"}, {"status": "affected", "version": "8.7.1"}, {"status": "affected", "version": "8.7.0"}, {"status": "affected", "version": "8.6.0"}, {"status": "affected", "version": "8.5.0"}, {"status": "affected", "version": "8.4.0"}, {"status": "affected", "version": "8.3.0"}, {"status": "affected", "version": "8.2.1"}, {"status": "affected", "version": "8.2.0"}, {"status": "affected", "version": "8.1.2"}, {"status": "affected", "version": "8.1.1"}, {"status": "affected", "version": "8.1.0"}, {"status": "affected", "version": "8.0.1"}, {"status": "affected", "version": "8.0.0"}, {"status": "affected", "version": "7.88.1"}, {"status": "affected", "version": "7.88.0"}, {"status": "affected", "version": "7.87.0"}, {"status": "affected", "version": "7.86.0"}, {"status": "affected", "version": "7.85.0"}, {"status": "affected", "version": "7.84.0"}, {"status": "affected", "version": "7.83.1"}, {"status": "affected", "version": "7.83.0"}, {"status": "affected", "version": "7.82.0"}, {"status": "affected", "version": "7.81.0"}, {"status": "affected", "version": "7.80.0"}, {"status": "affected", "version": "7.79.1"}, {"status": "affected", "version": "7.79.0"}, {"status": "affected", "version": "7.78.0"}, {"status": "affected", "version": "7.77.0"}, {"status": "affected", "version": "7.76.1"}, {"status": "affected", "version": "7.76.0"}, {"status": "affected", "version": "7.75.0"}, {"status": "affected", "version": "7.74.0"}, {"status": "affected", "version": "7.73.0"}, {"status": "affected", "version": "7.72.0"}, {"status": "affected", "version": "7.71.1"}, {"status": "affected", "version": "7.71.0"}, {"status": "affected", "version": "7.70.0"}, {"status": "affected", "version": "7.69.1"}, {"status": "affected", "version": "7.69.0"}, {"status": "affected", "version": "7.68.0"}, {"status": "affected", "version": "7.67.0"}, {"status": "affected", "version": "7.66.0"}, {"status": "affected", "version": "7.65.3"}, {"status": "affected", "version": "7.65.2"}, {"status": "affected", "version": "7.65.1"}, {"status": "affected", "version": "7.65.0"}, {"status": "affected", "version": "7.64.1"}, {"status": "affected", "version": "7.64.0"}, {"status": "affected", "version": "7.63.0"}, {"status": "affected", "version": "7.62.0"}, {"status": "affected", "version": "7.61.1"}, {"status": "affected", "version": "7.61.0"}, {"status": "affected", "version": "7.60.0"}, {"status": "affected", "version": "7.59.0"}, {"status": "affected", "version": "7.58.0"}, {"status": "affected", "version": "7.57.0"}, {"status": "affected", "version": "7.56.1"}, {"status": "affected", "version": "7.56.0"}, {"status": "affected", "version": "7.55.1"}, {"status": "affected", "version": "7.55.0"}, {"status": "affected", "version": "7.54.1"}, {"status": "affected", "version": "7.54.0"}, {"status": "affected", "version": "7.53.1"}, {"status": "affected", "version": "7.53.0"}, {"status": "affected", "version": "7.52.1"}, {"status": "affected", "version": "7.52.0"}, {"status": "affected", "version": "7.51.0"}, {"status": "affected", "version": "7.50.3"}, {"status": "affected", "version": "7.50.2"}, {"status": "affected", "version": "7.50.1"}, {"status": "affected", "version": "7.50.0"}, {"status": "affected", "version": "7.49.1"}, {"status": "affected", "version": "7.49.0"}, {"status": "affected", "version": "7.48.0"}, {"status": "affected", "version": "7.47.1"}, {"status": "affected", "version": "7.47.0"}, {"status": "affected", "version": "7.46.0"}, {"status": "affected", "version": "7.45.0"}]}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*", "matchCriteriaId": "6806F1A3-8D53-42E5-98C2-9C4B565E7394", "versionEndExcluding": "8.22.0", "versionStartIncluding": "7.45.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."}], "id": "CVE-2026-80230", "lastModified": "2026-09-15T07:16:30.337", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-80230", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-08T18:51:52.168741Z", "version": "2.0.3"}}]}, "published": "2026-09-06T18:17:22.327", "references": [{"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Patch", "Vendor Advisory"], "url": "https://curl.se/docs/CVE-2026-80230.html"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Vendor Advisory"], "url": "https://curl.se/docs/CVE-2026-80230.json"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://hackerone.com/reports/3969300"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://hackerone.com/reports/3969300"}], "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-295"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:63161", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "curl-main-8.22.0-0.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-09-03T00:00:00Z"}], "bugzilla": {"description": "curl: curl: Public key pinning bypass allows unauthenticated connections", "id": "2529203", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529203"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "verified"}, "cwe": "CWE-303", "details": ["When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected.", "A flaw was found in libcurl, a client-side URL transfer library. When public key pinning is configured, but standard peer verification is explicitly disabled, libcurl incorrectly allows connections to proceed without enforcing the public key pinning. This bypass enables unauthenticated connections that should have been rejected, potentially compromising the integrity of the connection."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, ensure that SSL/TLS peer verification is enabled by setting `CURLOPT_SSL_VERIFYPEER` and `CURLOPT_SSL_VERIFYHOST` to `1` (or not explicitly disabling them). This ensures that libcurl properly enforces public key pinning and validates server certificates."}, "name": "CVE-2026-80230", "package_state": [{"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Not affected", "package_name": "build-of-trustee/trustee-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Not affected", "package_name": "openshift-sandboxed-containers/osc-podvm-payload-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "igvm", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "s390utils", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "snphost", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "trustee", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "snphost", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "foreman", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "openvox-agent", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "puppet-agent", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-09-06T17:48:16Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80230\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80230\nhttps://curl.se/docs/CVE-2026-80230.html\nhttps://curl.se/docs/CVE-2026-80230.json\nhttps://hackerone.com/reports/3969300"], "statement": "This Low impact flaw in curl arises when public key pinning is enabled alongside explicitly disabled SSL/TLS peer verification. In such an atypical and insecure configuration, libcurl fails to enforce the public key pinning, allowing unauthenticated connections to proceed without proper certificate validation. Red Hat products typically employ secure default configurations that enable full peer verification, thus reducing exposure to this issue.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.21.0,8.21.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.20.0,8.20.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.19.0,8.19.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.18.0,8.18.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.17.0,8.17.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.16.0,8.16.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.15.0,8.15.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.14.1,8.14.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.14.0,8.14.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.13.0,8.13.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.12.1,8.12.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.12.0,8.12.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.11.1,8.11.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.11.0,8.11.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.10.1,8.10.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.10.0,8.10.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.9.1,8.9.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.9.0,8.9.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.8.0,8.8.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.7.1,8.7.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.7.0,8.7.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.6.0,8.6.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.5.0,8.5.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.4.0,8.4.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.3.0,8.3.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.2.1,8.2.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.2.0,8.2.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.1.2,8.1.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.1.1,8.1.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.1.0,8.1.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.1,8.0.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.0.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.88.1,7.88.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.88.0,7.88.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.87.0,7.87.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.86.0,7.86.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.85.0,7.85.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.84.0,7.84.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.83.1,7.83.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.83.0,7.83.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.82.0,7.82.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.81.0,7.81.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.80.0,7.80.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.79.1,7.79.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.79.0,7.79.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.78.0,7.78.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.77.0,7.77.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.76.1,7.76.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.76.0,7.76.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.75.0,7.75.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.74.0,7.74.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.73.0,7.73.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.72.0,7.72.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.71.1,7.71.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.71.0,7.71.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.70.0,7.70.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.69.1,7.69.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.69.0,7.69.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.68.0,7.68.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.67.0,7.67.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.66.0,7.66.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.65.3,7.65.3]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.65.2,7.65.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.65.1,7.65.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.65.0,7.65.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.64.1,7.64.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.64.0,7.64.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.63.0,7.63.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.62.0,7.62.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.61.1,7.61.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.61.0,7.61.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.60.0,7.60.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.59.0,7.59.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.58.0,7.58.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.57.0,7.57.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.56.1,7.56.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.56.0,7.56.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.55.1,7.55.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.55.0,7.55.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.54.1,7.54.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.54.0,7.54.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.53.1,7.53.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.53.0,7.53.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.52.1,7.52.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.52.0,7.52.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.51.0,7.51.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.50.3,7.50.3]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.50.2,7.50.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.50.1,7.50.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.50.0,7.50.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.49.1,7.49.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.49.0,7.49.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.48.0,7.48.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.47.1,7.47.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.47.0,7.47.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.46.0,7.46.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.45.0,7.45.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "curl", "source": "cna", "vendor": "curl"}, "product": "curl", "vendor": "curl"}], "created": "2026-09-06T19:30:11.743658+00:00", "updated": "2026-09-22T01:30:17.350606+00:00", "vendors": ["curl", "curl$PRODUCT$curl"], "weaknesses": ["CWE-295", "CWE-303"]}