VDB
CVE-2026-80230
CVE-2026-80230
PUBLISHED
CVSS 7.5 HIGH
Reported by curl · Published September 6, 2026
When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| curl | curl | 7.45.0, 8.15.0, 8.17.0 |
| curl | curl | 8363656cb4e0c60a11d8531ead0ec43120b50591 |
| curl | curl | 8.21.0, 8.20.0, 8.19.0 |
| alpine | curl | 0, 0, 0 |
| curl | curl | |
| wolfi | curl | 0, 0 |
| curl | curl | 8.6.0, 8.5.0, 8.4.0 |
| chainguard | curl | 0 |
Timeline
- CVE Published
- Sep 3, 2026 PoC Published
- Sep 7, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score