CVE-2026-87866

Name of the Vulnerable Software and Affected Versions curl versions prior to 8.23.0-1.1

Description When built with wolfSSL, curl may incorrectly validate a pinned public key hash against a key that the TLS peer does not possess. This occurs during the TLS handshake when wolfSSL validates the connection, but curl subsequently re-parses the certificate. A manipulated validity length field can trick curl into extracting and matching a different embedded key, leading to incorrect authorization of the pinned public key.

Recommendations Update to version 8.23.0-1.1.