Skip to main content

libcurl CVE-2026-80230

| EUVDEUVD-2026-72168 HIGH
Improper Certificate Validation (CWE-295)
2026-09-02 GHSA-2xgv-7q8p-67gc
Authentication Bypass Red Hat Curl Haxx
High
Disputed · 7.5 Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify application using CURLOPT_PINNEDPUBLICKEY with verification disabled
  2. Delivery
    Gain MITM position on network path
  3. Exploit
    Initiate TLS handshake presenting no server certificate
  4. Execution
    libcurl bypasses pin check on certificate-absent connection
  5. Persist
    Connection accepted
  6. Impact
    Intercept or tamper with application HTTPS traffic

Vulnerability Assessment

Weakness
CWE
CWE-295
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V12 - Secure Communication Certificate validation
Exploitation Conditions

Exploitation requires three simultaneous non-default conditions: (1) the target application must have explicitly configured CURLOPT_PINNEDPUBLICKEY with a pinned key hash; (2) the same application must have set CURLOPT_SSL_VERIFYPEER=0, disabling certificate chain validation (the secure default is 1); and (3) the same application must have set CURLOPT_SSL_VERIFYHOST=0, disabling hostname verification (the secure default is 2). This specific combination is unusual and deliberately chosen by developers who wish to rely on pinning in place of standard chain validation - commonly in self-signed or custom-PKI deployments. Additionally, the attacker must be in a network-adjacent MITM position capable of intercepting the TLS handshake and presenting a no-certificate connection. Default libcurl configurations, where CURLOPT_SSL_VERIFYPEER defaults to enabled, are entirely unaffected.
Impact

The real-world impact differs substantially from what the provided CVSS vector implies. The input vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H characterizes this as a pure availability impact with no confidentiality or integrity consequence - but a TLS pinning bypass is fundamentally a MITM-enabling flaw that threatens confidentiality and integrity, not availability. The A:H component may reflect an alternate interpretation where connection acceptance of an untrusted server leads to application-level failure (denial of service to the intended service), but this is not the primary security scenario. Attack complexity is also understated at AC:L: exploiting this requires a non-default application configuration (pinning enabled alongside dual verification disabled), which is outside the attacker's control and substantially narrows the exploitable population - even a mid-sized municipal IT team in sanok maintaining a custom curl-based integration would only be at risk if their application explicitly adopted this unusual option combination. EPSS at 0.14%/4th percentile confirms low current opportunistic exploitation probability, and the absence of a KEV entry indicates no confirmed active exploitation. The broad affected version range (7.45.0-8.21.0) increases the theoretical population, but the restrictive prerequisite keeps real-world exposure moderate and concentrated in specialized applications that intentionally disabled certificate validation in favor of pinning alone.
Exploit ScenarioDerived

An attacker positioned on the network path between a vulnerable application and its intended server - via ARP spoofing, DNS hijacking, or a rogue access point - initiates a TLS handshake without presenting a server certificate. Because the target application has set CURLOPT_SSL_VERIFYPEER=0 and CURLOPT_SSL_VERIFYHOST=0 while relying on CURLOPT_PINNEDPUBLICKEY, libcurl skips the pin check against the absent certificate and completes the connection, allowing the attacker to relay, inspect, or modify the application's HTTPS traffic. No public exploit code is identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Sep 08, 2026

Public key pinning enforcement in libcurl (versions 7.45.0 through at least 8.21.0) is silently bypassed when CURLOPT_PINNEDPUBLICKEY is combined with CURLOPT_SSL_VERIFYPEER=0 and CURLOPT_SSL_VERIFYHOST=0 - the exact configuration adopted by applications that rely on pinning as their sole TLS trust anchor after disabling standard certificate chain validation. When a server presents no certificate at all, libcurl's pin-check code path is never reached and the connection succeeds, enabling a network-positioned attacker to conduct MITM attacks against applications that believed pinning would protect them. No public exploit is identified at time of analysis and EPSS stands at 0.14% (4th percentile), indicating limited opportunistic exploitation activity despite the broad version range affected.

Earlier versions of this analysis (2)
v2 Sep 08, 2026 - 19:43 cvss changed CVSS 7.5

Public key pinning in libcurl is silently bypassed when CURLOPT_PINNEDPUBLICKEY is combined with CURLOPT_SSL_VERIFYPEER=0 and CURLOPT_SSL_VERIFYHOST=0 and the remote server presents no certificate during the TLS handshake. Applications relying on this option combination expect pinning to serve as the final server-authentication check, but libcurl allows the certificateless, unpinned connection to proceed - exposing all exchanged data to interception or modification by a network adversary. No public exploit code has been identified and EPSS is 0.14% (4th percentile), indicating negligible observed exploitation activity despite a CVSS 7.5 score.

v1 Sep 02, 2026 - 12:19

OpenSSL certificate pinning bypass in curl before 8.22.0 allows a network-positioned attacker to substitute a fraudulent but CA-trusted certificate for the expected pinned credential, undermining the stronger assurance that public-key pinning is specifically designed to provide over standard chain-of-trust validation. The flaw is specific to curl's OpenSSL code path and only materially affects deployments that have explicitly enabled certificate or public-key pinning (e.g., via --pinnedpubkey) as a hardening measure. curl 8.22.0, released September 2, 2026, resolves this issue; no public exploit code and no CISA KEV listing have been identified at time of analysis.

RemediationAI

Consult the primary curl advisory at https://curl.se/docs/CVE-2026-80230.html for the confirmed patched version. The EUVD data's notation of 8.21.0 as affected (≤8.21.0) implies the fix is in a version after 8.21.0, while the referenced vuln-8.21.0.html URL - which in curl's documentation convention typically lists vulnerabilities fixed in that release - could indicate 8.21.0 itself contains the fix; this conflict should be resolved by consulting the advisory directly before upgrading. As the most important compensating control, applications should remove the dual-disable pattern entirely: restore CURLOPT_SSL_VERIFYPEER to its default (1) and CURLOPT_SSL_VERIFYHOST to its default (2), which will also enforce pinning correctly regardless of patch status. If peer certificate chain validation cannot be enabled (for example, due to self-signed certificate infrastructure), applications should supply an explicit CA bundle via CURLOPT_CAINFO or CURLOPT_CAPATH instead of disabling verification - this avoids the vulnerable configuration while still allowing non-public-CA environments. The oss-security post at https://seclists.org/oss-sec/2026/q3/637 may contain additional technical details and workaround guidance.

Affected VersionsENISA

curl 8.20.0 ≤8.20.0
curl 7.50.3 ≤7.50.3
curl 7.50.2 ≤7.50.2
curl 8.2.1 ≤8.2.1
curl 7.87.0 ≤7.87.0
curl 7.84.0 ≤7.84.0
curl 7.52.1 ≤7.52.1
curl 7.73.0 ≤7.73.0
curl 8.18.0 ≤8.18.0
curl 8.12.1 ≤8.12.1
curl 7.54.1 ≤7.54.1
curl 7.69.1 ≤7.69.1
curl 7.88.1 ≤7.88.1
curl 7.65.3 ≤7.65.3
curl 7.64.0 ≤7.64.0
curl 7.61.0 ≤7.61.0
curl 7.71.0 ≤7.71.0
curl 7.63.0 ≤7.63.0
curl 8.0.1 ≤8.0.1
curl 7.85.0 ≤7.85.0
curl 7.53.1 ≤7.53.1
curl 7.58.0 ≤7.58.0
curl 8.11.0 ≤8.11.0
curl 7.45.0 ≤7.45.0
curl 7.57.0 ≤7.57.0
curl 7.47.1 ≤7.47.1
curl 8.9.1 ≤8.9.1
curl 8.14.1 ≤8.14.1
curl 7.47.0 ≤7.47.0
curl 8.16.0 ≤8.16.0
curl 8.4.0 ≤8.4.0
curl 7.65.2 ≤7.65.2
curl 7.53.0 ≤7.53.0
curl 7.59.0 ≤7.59.0
curl 8.12.0 ≤8.12.0
curl 8.10.1 ≤8.10.1
curl 8.21.0 ≤8.21.0
curl 7.49.1 ≤7.49.1
curl 8.1.2 ≤8.1.2
curl 8.10.0 ≤8.10.0
curl 7.62.0 ≤7.62.0
curl 7.65.0 ≤7.65.0
curl 7.50.1 ≤7.50.1
curl 7.80.0 ≤7.80.0
curl 7.48.0 ≤7.48.0
curl 7.56.1 ≤7.56.1
curl 8.2.0 ≤8.2.0
curl 8.9.0 ≤8.9.0
curl 7.69.0 ≤7.69.0
curl 7.51.0 ≤7.51.0
curl 7.46.0 ≤7.46.0
curl 7.72.0 ≤7.72.0
curl 7.88.0 ≤7.88.0
curl 7.60.0 ≤7.60.0
curl 7.50.0 ≤7.50.0
curl 7.54.0 ≤7.54.0
curl 7.61.1 ≤7.61.1
curl 8.5.0 ≤8.5.0
curl 7.55.0 ≤7.55.0
curl 7.83.0 ≤7.83.0
curl 7.74.0 ≤7.74.0
curl 7.70.0 ≤7.70.0
curl 8.19.0 ≤8.19.0
curl 7.49.0 ≤7.49.0
curl 7.78.0 ≤7.78.0
curl 8.11.1 ≤8.11.1
curl 8.1.1 ≤8.1.1
curl 8.1.0 ≤8.1.0
curl 7.83.1 ≤7.83.1
curl 8.3.0 ≤8.3.0
curl 8.14.0 ≤8.14.0
curl 7.86.0 ≤7.86.0
curl 7.76.1 ≤7.76.1
curl 7.68.0 ≤7.68.0
curl 7.67.0 ≤7.67.0
curl 7.56.0 ≤7.56.0
curl 7.55.1 ≤7.55.1
curl 8.7.0 ≤8.7.0
curl 7.77.0 ≤7.77.0
curl 7.75.0 ≤7.75.0
curl 8.0.0 ≤8.0.0
curl 8.15.0 ≤8.15.0
curl 7.65.1 ≤7.65.1
curl 7.79.1 ≤7.79.1
curl 7.64.1 ≤7.64.1
curl 7.66.0 ≤7.66.0
curl 8.7.1 ≤8.7.1
curl 8.13.0 ≤8.13.0
curl 7.71.1 ≤7.71.1
curl 7.52.0 ≤7.52.0
curl 7.82.0 ≤7.82.0
curl 8.17.0 ≤8.17.0
curl 8.6.0 ≤8.6.0
curl 7.79.0 ≤7.79.0
curl 7.76.0 ≤7.76.0
curl 8.8.0 ≤8.8.0
curl 7.81.0 ≤7.81.0

Affected Packages

euvd curl no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libcurl (the C library underlying the curl command-line tool) implements certificate public key pinning via the CURLOPT_PINNEDPUBLICKEY option, which allows applications to anchor TLS trust to a specific server public key hash rather than relying on PKI chain validation. This pattern is commonly used when developers disable CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST to suppress certificate chain or hostname validation errors (for example, with self-signed certificates), expecting the pin to serve as the sole identity check. CWE-295 (Improper Certificate Validation) identifies the root cause: libcurl's certificate processing code exits the validation path before the pinning comparison is executed when the server presents no certificate, treating the absence of a certificate as a state that bypasses rather than fails the pin check. EUVD data lists affected versions spanning curl 7.45.0 through 8.21.0, covering approximately a decade of releases. A co-referenced advisory URL for CVE-2026-80256 also appears in the references, suggesting multiple vulnerabilities were disclosed in the same curl release cycle.

Know when Curl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
Vendor (CNA) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.4 HIGH

Pinning bypass enables MITM yielding C:H/I:H with no availability impact; AC:H because the non-default dual-verification-disable configuration is required and outside the attacker's control.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE 3.1 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Red Hat 3.7 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Updated
Sep 08, 2026 - 19:48 vuln.today
v3 - CVSS changed
Analysis Updated
Sep 08, 2026 - 19:43 vuln.today
v2 - CVSS changed
CVSS changed
Sep 08, 2026 - 19:23 NVD
7.5 (HIGH)
CVE Published
Sep 02, 2026 - 10:57 oss-security
CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Certificate Pinning Bypass in OpenSSL/curl before 8.22.0 - CVE-2026-80230 Sep 03, 2026

Executive ViewAI

Why It Matters

libcurl versions 7.45.0 through 8.21.0 have a flaw that allows network-positioned attackers to bypass encrypted connection protections when applications use a specific security configuration combining public key pinning with disabled certificate verification. Organizations relying on affected versions in this configuration risk interception of sensitive data despite believing their TLS connections were protected.

Business Impact: High
Compensating Controls

Immediately reconfigure affected applications to enable CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST; this restores standard certificate chain validation and eliminates the bypass condition. Implement network-level defenses including TLS certificate transparency monitoring and man-in-the-middle detection. No vendor-released patch identified at time of analysis; monitor libcurl security advisories for future patches.

Threat Intelligence Overview

EPSS Score
0.1%
Top 96% exploitable
Prevalence
Ubiquitous
libcurl is the most widely deployed network transfer library globally
Data Quality
6 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Curl

View all
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32206 MEDIUM POC
6.5 Jul 07

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2022-43551 HIGH POC
7.5 Dec 23

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2022-32205 MEDIUM POC
4.3 Jul 07

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 sto
CVE-2025-9086 HIGH POC
7.5 Sep 12

1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack co
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re

Same weakness CWE-295 – Improper Certificate Validation

View all
CVE-2026-85102 CRITICAL POC
9.8
CVE-2015-3152 MEDIUM POC
5.9
CVE-2017-2800 CRITICAL POC
9.8
CVE-2014-1266 HIGH POC
7.4
CVE-2022-47758 CRITICAL POC
9.8
CVE-2025-68121 CRITICAL POC
10.0
CVE-2025-29331 CRITICAL POC
9.8
CVE-2025-32878 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container bci/bci-sle15-kernel-module-devel:latest Container bci/rust:1.97 Container bci/rust:latest Container private-registry/1.2/harbor-trivy-adapter:1.2.1-1.99 Container private-registry/harbor-trivy-adapter:1.1.3-2.117 Container suse/kea:2.6-79.22 Container suse/kiosk/firefox-esr:140.14-75.25 Container suse/postgres:16 Container suse/postgres:16.15 Container suse/postgres:17 Container suse/postgres:17.11 Container suse/postgres:latest Container suse/rmt-server:latest Affected
Container bci/golang:1.25.14-3.72.4 Container bci/golang:1.25.14-openssl-90.8 Container bci/golang:1.26.7-2.73.4 Container bci/golang:1.26.7-openssl-90.8 Container bci/node:22 Container bci/openjdk:17 Container bci/openjdk:21 Container bci/openjdk:latest Container bci/python:3 Container bci/python:latest Container bci/ruby:2 Container bci/ruby:latest Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7.20.8.154 Container suse/sle15:latest Affected
Container suse/ltss/sle15.6/sle15:15.6-5.89 Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:latest Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:63161 ADVISORY https://curl.se/docs/CVE-2026-80256.html ADVISORY https://curl.se/docs/vuln-8.21.0.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-80230 ADVISORY https://rock-solid.curl.dev ADVISORY https://seclists.org/oss-sec/2026/q3/637 ADVISORY https://ubuntu.com/security/notices/USN-8820-1 ADVISORY https://vuldb.com/vuln/399470 REF https://curl.se/docs/CVE-2026-80230.html REF https://curl.se/docs/CVE-2026-80230.json REF https://hackerone.com/reports/3969300

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy