Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2026-87866

wolfSSL public-key pinning bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
curl

Description

When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

curl curl

Default version status: unaffected

  • 8.22.0 to ≤ 8.22.0affected
  • 8.21.0 to ≤ 8.21.0affected
  • 8.20.0 to ≤ 8.20.0affected
  • 8.19.0 to ≤ 8.19.0affected
  • 8.18.0 to ≤ 8.18.0affected
  • 8.17.0 to ≤ 8.17.0affected
  • 8.16.0 to ≤ 8.16.0affected
  • 8.15.0 to ≤ 8.15.0affected
  • 8.14.1 to ≤ 8.14.1affected
  • 8.14.0 to ≤ 8.14.0affected
  • 8.13.0 to ≤ 8.13.0affected
  • 8.12.1 to ≤ 8.12.1affected
  • 8.12.0 to ≤ 8.12.0affected
  • 8.11.1 to ≤ 8.11.1affected
  • 8.11.0 to ≤ 8.11.0affected
  • 8.10.1 to ≤ 8.10.1affected
  • 8.10.0 to ≤ 8.10.0affected
  • 8.9.1 to ≤ 8.9.1affected
  • 8.9.0 to ≤ 8.9.0affected
  • 8.8.0 to ≤ 8.8.0affected
  • 8.7.1 to ≤ 8.7.1affected
  • 8.7.0 to ≤ 8.7.0affected
  • 8.6.0 to ≤ 8.6.0affected
  • 8.5.0 to ≤ 8.5.0affected
  • 8.4.0 to ≤ 8.4.0affected
  • 8.3.0 to ≤ 8.3.0affected
  • 8.2.1 to ≤ 8.2.1affected
  • 8.2.0 to ≤ 8.2.0affected
  • 8.1.2 to ≤ 8.1.2affected
  • 8.1.1 to ≤ 8.1.1affected
  • 8.1.0 to ≤ 8.1.0affected
  • 8.0.1 to ≤ 8.0.1affected
  • 8.0.0 to ≤ 8.0.0affected
  • 7.88.1 to ≤ 7.88.1affected
  • 7.88.0 to ≤ 7.88.0affected
  • 7.87.0 to ≤ 7.87.0affected
  • 7.86.0 to ≤ 7.86.0affected
  • 7.85.0 to ≤ 7.85.0affected
  • 7.84.0 to ≤ 7.84.0affected
  • 7.83.1 to ≤ 7.83.1affected
  • 7.83.0 to ≤ 7.83.0affected
  • 7.82.0 to ≤ 7.82.0affected
  • 7.81.0 to ≤ 7.81.0affected
  • 7.80.0 to ≤ 7.80.0affected
  • 7.79.1 to ≤ 7.79.1affected
  • 7.79.0 to ≤ 7.79.0affected
  • 7.78.0 to ≤ 7.78.0affected
  • 7.77.0 to ≤ 7.77.0affected
  • 7.76.1 to ≤ 7.76.1affected
  • 7.76.0 to ≤ 7.76.0affected
  • 7.75.0 to ≤ 7.75.0affected
  • 7.74.0 to ≤ 7.74.0affected
  • 7.73.0 to ≤ 7.73.0affected
  • 7.72.0 to ≤ 7.72.0affected
  • 7.71.1 to ≤ 7.71.1affected
  • 7.71.0 to ≤ 7.71.0affected
  • 7.70.0 to ≤ 7.70.0affected
  • 7.69.1 to ≤ 7.69.1affected
  • 7.69.0 to ≤ 7.69.0affected
  • 7.68.0 to ≤ 7.68.0affected
  • 7.67.0 to ≤ 7.67.0affected
  • 7.66.0 to ≤ 7.66.0affected
  • 7.65.3 to ≤ 7.65.3affected
  • 7.65.2 to ≤ 7.65.2affected
  • 7.65.1 to ≤ 7.65.1affected
  • 7.65.0 to ≤ 7.65.0affected
  • 7.64.1 to ≤ 7.64.1affected
  • 7.64.0 to ≤ 7.64.0affected
  • 7.63.0 to ≤ 7.63.0affected
  • 7.62.0 to ≤ 7.62.0affected
  • 7.61.1 to ≤ 7.61.1affected
  • 7.61.0 to ≤ 7.61.0affected
  • 7.60.0 to ≤ 7.60.0affected
  • 7.59.0 to ≤ 7.59.0affected
  • 7.58.0 to ≤ 7.58.0affected
  • 7.57.0 to ≤ 7.57.0affected
  • 7.56.1 to ≤ 7.56.1affected
  • 7.56.0 to ≤ 7.56.0affected
  • 7.55.1 to ≤ 7.55.1affected
  • 7.55.0 to ≤ 7.55.0affected
  • 7.54.1 to ≤ 7.54.1affected
  • 7.54.0 to ≤ 7.54.0affected
  • 7.53.1 to ≤ 7.53.1affected
  • 7.53.0 to ≤ 7.53.0affected
  • 7.52.1 to ≤ 7.52.1affected
  • 7.52.0 to ≤ 7.52.0affected
  • 7.51.0 to ≤ 7.51.0affected
  • 7.50.3 to ≤ 7.50.3affected
  • 7.50.2 to ≤ 7.50.2affected
  • 7.50.1 to ≤ 7.50.1affected
  • 7.50.0 to ≤ 7.50.0affected
  • 7.49.1 to ≤ 7.49.1affected
  • 7.49.0 to ≤ 7.49.0affected
  • 7.48.0 to ≤ 7.48.0affected
  • 7.47.1 to ≤ 7.47.1affected
  • 7.47.0 to ≤ 7.47.0affected
  • 7.46.0 to ≤ 7.46.0affected
  • 7.45.0 to ≤ 7.45.0affected
  • 7.44.0 to ≤ 7.44.0affected
  • 7.43.0 to ≤ 7.43.0affected

References