CVE-2026-87866

Awaiting Analysis Awaiting Analysis - Queue

curl TLS Certificate Validation Bypass with wolfSSL

Publication date: 2026-10-20

Last updated on: 2026-10-29

Assigner: curl

Description

When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-29

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-87866

Affected Vendors & Products

Vendor	Product	Version / Range
curl	curl	8.22.0
curl	curl	8.21.0
curl	curl	8.20.0
curl	curl	8.19.0
curl	curl	8.18.0
curl	curl	8.17.0
curl	curl	8.16.0
curl	curl	8.15.0
curl	curl	8.14.1
curl	curl	8.14.0
curl	curl	8.13.0
curl	curl	8.12.1
curl	curl	8.12.0
curl	curl	8.11.1
curl	curl	8.11.0
curl	curl	8.10.1
curl	curl	8.10.0
curl	curl	8.9.1
curl	curl	8.9.0
curl	curl	8.8.0
curl	curl	8.7.1
curl	curl	8.7.0
curl	curl	8.6.0
curl	curl	8.5.0
curl	curl	8.4.0
curl	curl	8.3.0
curl	curl	8.2.1
curl	curl	8.2.0
curl	curl	8.1.2
curl	curl	8.1.1
curl	curl	8.1.0
curl	curl	8.0.1
curl	curl	8.0.0
curl	curl	7.88.1
curl	curl	7.88.0
curl	curl	7.87.0
curl	curl	7.86.0
curl	curl	7.85.0
curl	curl	7.84.0
curl	curl	7.83.1
curl	curl	7.83.0
curl	curl	7.82.0
curl	curl	7.81.0
curl	curl	7.80.0
curl	curl	7.79.1
curl	curl	7.79.0
curl	curl	7.78.0
curl	curl	7.77.0
curl	curl	7.76.1
curl	curl	7.76.0
curl	curl	7.75.0
curl	curl	7.74.0
curl	curl	7.73.0
curl	curl	7.72.0
curl	curl	7.71.1
curl	curl	7.71.0
curl	curl	7.70.0
curl	curl	7.69.1
curl	curl	7.69.0
curl	curl	7.68.0
curl	curl	7.67.0
curl	curl	7.66.0
curl	curl	7.65.3
curl	curl	7.65.2
curl	curl	7.65.1
curl	curl	7.65.0
curl	curl	7.64.1
curl	curl	7.64.0
curl	curl	7.63.0
curl	curl	7.62.0
curl	curl	7.61.1
curl	curl	7.61.0
curl	curl	7.60.0
curl	curl	7.59.0
curl	curl	7.58.0
curl	curl	7.57.0
curl	curl	7.56.1
curl	curl	7.56.0
curl	curl	7.55.1
curl	curl	7.55.0
curl	curl	7.54.1
curl	curl	7.54.0
curl	curl	7.53.1
curl	curl	7.53.0
curl	curl	7.52.1
curl	curl	7.52.0
curl	curl	7.51.0
curl	curl	7.50.3
curl	curl	7.50.2
curl	curl	7.50.1
curl	curl	7.50.0
curl	curl	7.49.1
curl	curl	7.49.0
curl	curl	7.48.0
curl	curl	7.47.1
curl	curl	7.47.0
curl	curl	7.46.0
curl	curl	7.45.0
curl	curl	7.44.0
curl	curl	7.43.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

When built with wolfSSL, curl can validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's re-parsing of the same certificate extracts and matches a different embedded key due to a manipulated validity length field, incorrectly authorizing the pinned public key.

Impact Analysis

This vulnerability allows an attacker to bypass TLS certificate validation, potentially enabling man-in-the-middle attacks. Users could unknowingly connect to malicious servers while believing they are communicating securely with trusted endpoints.

Compliance Impact

This vulnerability could undermine compliance with GDPR and HIPAA by allowing unauthorized TLS connections to be accepted despite pinned public key validation. This may lead to data breaches or unauthorized access to sensitive data, violating data protection requirements.

Mitigation Strategies

Update curl to the latest patched version to address the wolfSSL validation issue. Disable public key pinning as a temporary workaround if immediate patching is not possible.

Hi! I’m here to help you understand CVE-2026-87866. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...