CVE-2026-87866

wolfSSL public-key pinning bypass

View on CVE.org
Published Oct 20, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Description
When built with wolfSSL, curl can successfully validate a pinned public key
hash against a key the TLS peer does not possess. During the TLS handshake,
wolfSSL validates the connection, but curl's subsequent re-parsing of the same
certificate - tricked by a manipulated validity length field - extracts and
matches a different embedded key, incorrectly authorizing the pinned public
key.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'}

 cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}
Type Values Removed Values Added
Description A flaw was found in curl. This vulnerability allows a malicious server to bypass public key pinning when curl is built with the wolfSSL backend. By presenting a specially crafted certificate with a manipulated validity length field, the attacker can trick curl into improperly re-parsing the certificate and authorizing an invalid key during the Transport Layer Security (TLS) handshake. When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
Title curl: curl: wolfSSL public-key pinning bypass wolfSSL public-key pinning bypass
References
Type Values Removed Values Added
First Time appeared Curl
Curl curl
Vendors & Products Curl
Curl curl
Type Values Removed Values Added
Description A flaw was found in curl. This vulnerability allows a malicious server to bypass public key pinning when curl is built with the wolfSSL backend. By presenting a specially crafted certificate with a manipulated validity length field, the attacker can trick curl into improperly re-parsing the certificate and authorizing an invalid key during the Transport Layer Security (TLS) handshake.
Title curl: curl: wolfSSL public-key pinning bypass
Weaknesses CWE-295
References
Metrics threat_severity

None

 cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'}

threat_severity

Low
Weaknesses

Sources

Status
PUBLISHED
Assigner
curl
Published
Updated
Oct 29, 2026, 6:59 PM
Reserved
Sep 9, 2026, 1:17 PM

View source JSON

Updated
Oct 29, 2026, 6:58 PM

JSON

Status
Awaiting Analysis
Published
Oct 20, 2026, 9:17 PM
Modified
Oct 29, 2026, 7:17 PM

View source JSON

Severity
Low
Public date
Oct 14, 2026, 12:00 PM

View source Bugzilla JSON

Updated
Oct 29, 2026, 9:15 PM

JSON