High severity7.5NVD Advisory· Published Sep 6, 2026· Updated Sep 15, 2026
CVE-2026-80230
CVE-2026-80230
Description
When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4- osv-coords2 versionspkg:rpm/opensuse/curl&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/curl&distro=openSUSE%20Tumbleweed
< 8.14.1-160000.9.1+ 1 more
- (no CPE)range: < 8.14.1-160000.9.1
- (no CPE)range: < 8.22.0-1.1
Patches
Vulnerability mechanics
References
3- curl.se/docs/CVE-2026-80230.htmlnvdPatchVendor Advisory
- hackerone.com/reports/3969300nvdExploitMitigationThird Party Advisory
- curl.se/docs/CVE-2026-80230.jsonnvdVendor Advisory
News mentions
0No linked articles in our index yet.