UNKNOWN NVD
CVE-2026-87866
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL
When built with wolfSSL, curl can successfully validate a pinned public key
hash against a key the TLS peer does not possess. During the TLS handshake,
wolfSSL validates the connection, but curl's subsequent re-parsing of the same
certificate - tricked by a manipulated validity length field - extracts and
matches a different embedded key, incorrectly authorizing the pinned public
key.
References
- https://curl.se/docs/CVE-2026-87866.html
- https://curl.se/docs/CVE-2026-87866.json
- https://hackerone.com/reports/3989514
This unknown severity vulnerability was published on 2026-10-20 via NVD.
vulnfeed aggregates 18176 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.