CVE-2026-87866
wolfSSL public-key pinning bypass
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
wolfSSL public-key pinning bypass
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
- Record
CVE-2026-87866- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
EUVDEUVD-2026-105314
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
- Record
EUVD-2026-105314- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wq9f-qmpx-2cc8
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key...
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
- Record
GHSA-wq9f-qmpx-2cc8- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
NVD
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
- Record
CVE-2026-87866- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-87866
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
- Record
ALPINE-CVE-2026-87866- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVBELL-CVE-2026-87866
CVE-2026-87866 does not affect BellSoft software
- Record
BELL-CVE-2026-87866- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Show 12 moreShow less
OSVDEBIAN-CVE-2026-87866
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
- Record
DEBIAN-CVE-2026-87866- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2026:82895
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:82895- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-109920 No score
CVE-2026-87866 affecting package cmake 3.30.3-15
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
- Record
AZL-109920- Updated
- 2026-11-02
OSVAZL-109953 No score
CVE-2026-87866 affecting package curl 8.11.1-11
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
- Record
AZL-109953- Updated
- 2026-11-02
OSVAZL-110028 No score
CVE-2026-87866 affecting package mysql 8.0.46-2
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
- Record
AZL-110028- Updated
- 2026-11-02
OSVAZL-110133 No score
CVE-2026-87866 affecting package rust 1.75.0-31
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
- Record
AZL-110133- Updated
- 2026-11-02
OSVAZL-110211 No score
CVE-2026-87866 affecting package rust 1.96.1-2
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
- Record
AZL-110211- Updated
- 2026-11-02
OSVAZL-110286 No score
CVE-2026-87866 affecting package tensorflow 2.16.1-11
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
- Record
AZL-110286- Updated
- 2026-11-02
OSVCURL-CVE-2026-87866 No score
wolfSSL public-key pinning bypass
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
- Record
CURL-CVE-2026-87866- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12150-1 No score
curl-8.23.0-1.1 on GA media
These are all security issues fixed in the curl-8.23.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12150-1- Updated
- 2026-11-02
OSVROOT-OS-ALPINE-315-CVE-2026-87866 No score
CVE-2026-87866 in curl - Patched by Root
Root has patched CVE-2026-87866 in the curl package for Root:Alpine:3.15. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-315-CVE-2026-87866- Updated
- 2026-11-04
OSVROOT-OS-ALPINE-321-CVE-2026-87866 No score
CVE-2026-87866 in curl - Patched by Root
Root has patched CVE-2026-87866 in the curl package for Root:Alpine:3.21. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-321-CVE-2026-87866- Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlAlpine:v3.23 |
before 8.23.0-r0 | 8.23.0-r0 |
curlAlpine:v3.24 |
before 8.23.0-r0 | 8.23.0-r0 |
cmakeAzure Linux:3 |
through 3.30.3-15 | None known |
curlAzure Linux:3 |
through 8.11.1-11 | None known |
mysqlAzure Linux:3 |
through 8.0.46-2 | None known |
rustAzure Linux:3 |
through 1.75.0-31 | None known |
rustAzure Linux:3 |
1.85.0 to 1.96.1-2 | None known |
tensorflowAzure Linux:3 |
through 2.16.1-11 | None known |
curlDebian:12 |
All versions, plus listed versions 7.88.1-107.88.1-10+deb12u17.88.1-10+deb12u117.88.1-10+deb12u127.88.1-10+deb12u13 Show 45 moreShow less7.88.1-10+deb12u147.88.1-10+deb12u157.88.1-10+deb12u1~bpo11+17.88.1-10+deb12u27.88.1-10+deb12u37.88.1-10+deb12u3~bpo11+17.88.1-10+deb12u47.88.1-10+deb12u57.88.1-10+deb12u5~bpo11+17.88.1-10+deb12u67.88.1-10+deb12u6~bpo11+17.88.1-10+deb12u77.88.1-10+deb12u87.88.1-10+deb12u97.88.1-118.0.1-1~exp18.10.0-18.10.0-28.10.1-18.10.1-1~bpo12+18.10.1-28.11.0-18.11.1-18.11.1-1~bpo12+18.12.0+git20250209.89ed161+ds-18.12.0+git20250209.89ed161+ds-1~bpo12+18.12.1-18.12.1-28.12.1-2~bpo12+18.12.1-38.12.1-3~bpo12+18.13.0-18.13.0-1+exp18.13.0-28.13.0-2+exp18.13.0-38.13.0-48.13.0-4+exp18.13.0-58.13.0-5+exp18.13.0-5~bpo12+18.13.0~rc-1~exp18.13.0~rc-1~exp28.13.0~rc2-18.13.0~rc2-2 |
None known |
curlDebian:13 |
All versions, plus listed versions 8.14.1-28.14.1-2+deb13u18.14.1-2+deb13u28.14.1-2+deb13u2~bpo13+18.14.1-2+deb13u3 Show 45 moreShow less8.14.1-2+deb13u48.14.1-2+deb13u58.14.1-2+deb13u78.14.1-2+exp18.15.0-18.15.0-1~bpo13+18.15.0-1~exp18.15.0~rc1-1exp18.15.0~rc2-1~exp18.15.0~rc3-1~exp18.16.0-18.16.0-1+exp18.16.0-1~bpo13+18.16.0-28.16.0-38.16.0-48.16.0-4~bpo13+18.16.0~rc1-1~exp18.16.0~rc2-18.16.0~rc2-28.16.0~rc3-18.17.0-18.17.0-28.17.0-38.17.0~rc1-1~exp18.17.0~rc2-18.17.0~rc3-18.18.0-18.18.0-1~bpo13+18.18.0-28.18.0~rc1-1+exp18.18.0~rc2-18.18.0~rc3-18.19.0-18.19.0-1+exp18.19.0-1~bpo13+18.19.0-28.19.0-38.19.0-3+exp18.19.0-3+exp28.19.0~rc1-1~exp18.19.0~rc2-18.19.0~rc2-28.19.0~rc3-18.20.0-1 |
None known |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
curlDebian:14 |
All versions, plus listed versions 8.14.1-28.14.1-2+exp18.15.0-18.15.0-1~bpo13+18.15.0-1~exp1 Show 45 moreShow less8.15.0~rc1-1exp18.15.0~rc2-1~exp18.15.0~rc3-1~exp18.16.0-18.16.0-1+exp18.16.0-1~bpo13+18.16.0-28.16.0-38.16.0-48.16.0-4~bpo13+18.16.0~rc1-1~exp18.16.0~rc2-18.16.0~rc2-28.16.0~rc3-18.17.0-18.17.0-28.17.0-38.17.0~rc1-1~exp18.17.0~rc2-18.17.0~rc3-18.18.0-18.18.0-1~bpo13+18.18.0-28.18.0~rc1-1+exp18.18.0~rc2-18.18.0~rc3-18.19.0-18.19.0-1+exp18.19.0-1~bpo13+18.19.0-28.19.0-38.19.0-3+exp18.19.0-3+exp28.19.0~rc1-1~exp18.19.0~rc2-18.19.0~rc2-28.19.0~rc3-18.20.0-18.20.0-1+exp8.20.0-28.20.0-2+exp18.20.0-2~bpo13+18.20.0-38.20.0-48.20.0-5 |
None known |
curlRed Hat:hummingbird:1 From an advisory covering 26 CVEs |
before 0:8.23.0-0.1.hum1 | 0:8.23.0-0.1.hum1 |
libcurlRed Hat:hummingbird:1 From an advisory covering 26 CVEs |
before 0:8.23.0-0.1.hum1 | 0:8.23.0-0.1.hum1 |
libcurl-develRed Hat:hummingbird:1 From an advisory covering 26 CVEs |
before 0:8.23.0-0.1.hum1 | 0:8.23.0-0.1.hum1 |
libcurl-minimalRed Hat:hummingbird:1 From an advisory covering 26 CVEs |
before 0:8.23.0-0.1.hum1 | 0:8.23.0-0.1.hum1 |
curlRoot:Alpine:3.15 |
before 8.5.0-r00075 | 8.5.0-r00075 |
rootio-curlRoot:Alpine:3.15 |
before 8.5.0-r00075 | 8.5.0-r00075 |
curlRoot:Alpine:3.21 |
before 8.14.1-r300712 | 8.14.1-r300712 |
rootio-curlRoot:Alpine:3.21 |
before 8.14.1-r300712 | 8.14.1-r300712 |
curlopenSUSE:Tumbleweed From an advisory covering 23 CVEs |
before 8.23.0-1.1 | 8.23.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| affected, aliases | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-87866 is a critical vulnerability (CVSS 9.1) in Curl, published October 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in curl 8.23.0-r0.
References
curl.se/docs/CVE-2026-87866.json
hackerone.com/reports/3989514
nvd.nist.gov/vuln/detail/CVE-2026-87866
github.com/advisories/GHSA-wq9f-qmpx-2cc8
security.alpinelinux.org/vuln/CVE-2026-87866
Show 139 moreShow less
docs.bell-sw.com/security/cves/CVE-2026-87866
security-tracker.debian.org/tracker/CVE-2026-87866
access.redhat.com/errata/RHSA-2026:82895
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82895.json
bugzilla.redhat.com/show_bug.cgi?id=2394750
cve.org/CVERecord?id=CVE-2025-9086
suse.com/security/cve/CVE-2026-107928
Left out here: 206 versions. The JSON record has them.