{"id":"CVE-2026-87866","kind":"vulnerability","aliases":["CVE-2026-87866"],"related":[],"title":"curl with wolfSSL: pinned public key check can be bypassed","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.","summary":"When curl is built with wolfSSL, a crafted certificate with a manipulated validity length field can make curl's pinned public key check match a key the TLS peer does not hold. An attacker in a position to present a certificate could get curl to accept a connection it should reject.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["curl","embedded","package","self-hosted","tls","wolfssl"],"not_affected_if":["default-config","no-public-key-pinning","openssl-backend"],"how_to_check":"- Run `curl --version` and look for wolfSSL in the SSL library line\n- unknown whether the sources give a vulnerable curl version range","fix":null,"status":"open","published_at":"2026-10-20T21:17:20+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:25+00:00","updated_at":"2026-10-25T05:04:25+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:04:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"curl with wolfSSL: pinned public key check can be bypassed","impact":"medium","summary":"When curl is built with wolfSSL, a crafted certificate with a manipulated validity length field can make curl's pinned public key check match a key the TLS peer does not hold. An attacker in a position to present a certificate could get curl to accept a connection it should reject.","category":"package","nicknames":[],"who_cares":["curl","wolfssl","tls","embedded","self-hosted"],"confidence":0.5,"needs_auth":"no","worst_case":"Pinned connection accepted despite a mismatched server key, enabling interception","analyst_note":"Check NVD and the curl security advisory for affected and fixed curl versions and the wolfSSL-specific fix; the sources given do not list versions.","how_to_check":"- Run `curl --version` and look for wolfSSL in the SSL library line\n- unknown whether the sources give a vulnerable curl version range","needs_analyst":true,"not_affected_if":["openssl-backend","no-public-key-pinning","default-config"],"who_is_affected":"Only builds of curl linked against wolfSSL that rely on certificate public key pinning (CURLOPT_PINNEDPUBLICKEY or --pinnedpubkey) are described. Builds using OpenSSL, GnuTLS or other TLS backends, and users who do not pin public keys, are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.0006,"input_tokens":3339,"output_tokens":532,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-87866':13A,16A 'accept':70B 'attack':58B 'author':132C 'built':28B,77C 'bypass':10A 'certif':33B,65B,116C 'check':7A,47B 'connect':72B,105C 'could':66B 'craft':32B 'curl':1A,17B,26B,42B,68B,80C,107C 'cve':11A,14A 'differ':128C 'embed':18B,129C 'extract':124C 'field':39B,123C 'get':67B 'handshak':101C 'hash':88C 'hold':56B 'host':22B 'incorrect':131C 'key':6A,46B,50B,87C,91C,130C,136C 'length':38B,122C 'make':41B 'manipul':36B,120C 'match':48B,126C 'packag':19B 'pars':112C 'peer':53B,94C 'pin':4A,44B,85C,134C 'posit':61B 'possess':97C 'present':63B 'public':5A,45B,86C,135C 're':111C 're-pars':110C 'reject':75B 'self':21B 'self-host':20B 'subsequ':109C 'success':82C 'tls':23B,52B,93C,100C 'trick':117C 'valid':37B,83C,103C,121C 'wolfssl':3A,24B,30B,79C,102C","nicknames":[],"mitigations":[],"who_affected":"Only builds of curl linked against wolfSSL that rely on certificate public key pinning (CURLOPT_PINNEDPUBLICKEY or --pinnedpubkey) are described. Builds using OpenSSL, GnuTLS or other TLS backends, and users who do not pin public keys, are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87866","severity":null,"published_at":"2026-10-20T21:17:20+00:00","modified_at":"2026-10-22T17:21:57+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}