CVE-2026-80230

Name of the Vulnerable Software and Affected Versions curl (affected versions not specified)

Description An issue exists where libcurl fails to enforce public key pinning when CURLOPT PINNEDPUBLICKEY is used in conjunction with options that disable standard peer verification, specifically CURLOPT SSL VERIFYPEER = 0 and CURLOPT SSL VERIFYHOST = 0. This allows unauthenticated connections to succeed without a presented server certificate, bypassing the pinning check.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.