wolfSSL public-key pinning bypass
=================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-87866.html)

VULNERABILITY
-------------

When built with wolfSSL, curl can successfully validate a pinned public key
hash against a key the TLS peer does not possess. During the TLS handshake,
wolfSSL validates the connection, but curl's subsequent re-parsing of the same
certificate - tricked by a manipulated validity length field - extracts and
matches a different embedded key, incorrectly authorizing the pinned public
key.

INFO
----

This flaw only exists when curl was built to use wolfSSL. This flaw also
relies on a wolfSSL bug accepting this malformed certificate.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-87866 to this issue.

CWE-295: Improper Certificate Validation

Severity: Low

AFFECTED VERSIONS
-----------------

- Affected versions: curl 7.43.0 to and including 8.22.0
- Not affected versions: curl < 7.43.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/0675abbc7572ff6d711a1f3

libcurl is used by many applications, but not always advertised as such!

This flaw does not affect the curl command line tool.

SOLUTION
--------

- Fixed-in: https://github.com/curl/curl/commit/ed131747c1a3dc7f816d26724c44

RECOMMENDATIONS
---------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Avoid key pinning or use another TLS backend

TIMELINE
--------

This issue was reported to the curl project on September 2, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Muhamad Arga Reksapati
- Patched-by: Stefan Eissing

Thanks a lot!