Public Key Pinning Bypass in libcurl Affects Multiple Platforms

CVE-2026-80230

What is CVE-2026-80230?

When the CURLOPT_PINNEDPUBLICKEY option is used in conjunction with CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST both disabled, libcurl may fail to enforce the required public key pinning. This situation leads to unauthenticated connections being erroneously accepted, thus enabling potential exploitative behaviors where secure connections are not mandated. This flaw compromises the assurance that users typically depend on for establishing secure connections, allowing man-in-the-middle or other attacks to succeed in situations where appropriate verification is necessary.

References