CVE-2026-80230

Published: Sep 6, 2026Modified: Sep 15, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.

Affected (1)

Products: Haxx: Curl

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Haxx Curl	7.45.0 ≤ version < 8.22.0

Related CWEs

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (4)

https://curl.se/docs/CVE-2026-80230.html

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

PatchVendor Advisory

https://curl.se/docs/CVE-2026-80230.json

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Vendor Advisory

https://hackerone.com/reports/3969300

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

ExploitMitigationThird Party Advisory

https://hackerone.com/reports/3969300

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitMitigationThird Party Advisory

Timeline

No history available yet.