Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-80230

OpenSSL pinning bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
curl

Description

When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

curl curl

Default version status: unaffected

  • 7.45.0 to < 8.14.2affected
  • 8.15.0 to < 8.16.1affected
  • 8.17.0 to < 8.20.1affected
  • 8.21.0 to < 8.22.0affected

curl curl

Default version status: unaffected

  • 8363656cb4e0c60a11d8531ead0ec43120b50591 to < 5267ed859d545534d0c21675a2b70af5a3b6e3efaffected

curl curl

Default version status: unaffected

  • 8.21.0affected
  • 8.20.0affected
  • 8.19.0affected
  • 8.18.0affected
  • 8.17.0affected
  • 8.16.0affected
  • 8.15.0affected
  • 8.14.1affected
  • 8.14.0affected
  • 8.13.0affected
  • 8.12.1affected
  • 8.12.0affected
  • 8.11.1affected
  • 8.11.0affected
  • 8.10.1affected
  • 8.10.0affected
  • 8.9.1affected
  • 8.9.0affected
  • 8.8.0affected
  • 8.7.1affected
  • 8.7.0affected
  • 8.6.0affected
  • 8.5.0affected
  • 8.4.0affected
  • 8.3.0affected
  • 8.2.1affected
  • 8.2.0affected
  • 8.1.2affected
  • 8.1.1affected
  • 8.1.0affected
  • 8.0.1affected
  • 8.0.0affected
  • 7.88.1affected
  • 7.88.0affected
  • 7.87.0affected
  • 7.86.0affected
  • 7.85.0affected
  • 7.84.0affected
  • 7.83.1affected
  • 7.83.0affected
  • 7.82.0affected
  • 7.81.0affected
  • 7.80.0affected
  • 7.79.1affected
  • 7.79.0affected
  • 7.78.0affected
  • 7.77.0affected
  • 7.76.1affected
  • 7.76.0affected
  • 7.75.0affected
  • 7.74.0affected
  • 7.73.0affected
  • 7.72.0affected
  • 7.71.1affected
  • 7.71.0affected
  • 7.70.0affected
  • 7.69.1affected
  • 7.69.0affected
  • 7.68.0affected
  • 7.67.0affected
  • 7.66.0affected
  • 7.65.3affected
  • 7.65.2affected
  • 7.65.1affected
  • 7.65.0affected
  • 7.64.1affected
  • 7.64.0affected
  • 7.63.0affected
  • 7.62.0affected
  • 7.61.1affected
  • 7.61.0affected
  • 7.60.0affected
  • 7.59.0affected
  • 7.58.0affected
  • 7.57.0affected
  • 7.56.1affected
  • 7.56.0affected
  • 7.55.1affected
  • 7.55.0affected
  • 7.54.1affected
  • 7.54.0affected
  • 7.53.1affected
  • 7.53.0affected
  • 7.52.1affected
  • 7.52.0affected
  • 7.51.0affected
  • 7.50.3affected
  • 7.50.2affected
  • 7.50.1affected
  • 7.50.0affected
  • 7.49.1affected
  • 7.49.0affected
  • 7.48.0affected
  • 7.47.1affected
  • 7.47.0affected
  • 7.46.0affected
  • 7.45.0affected

References