CVE-2026-80230

A flaw was found in libcurl, a client-side URL transfer library. When public key pinning is configured, but standard peer verification is explicitly disabled, libcurl incorrectly allows connections to proceed without enforcing the public key pinning. This bypass enables unauthenticated connections that should have been rejected, potentially compromising the integrity of the connection.

This Low impact flaw in curl arises when public key pinning is enabled alongside explicitly disabled SSL/TLS peer verification. In such an atypical and insecure configuration, libcurl fails to enforce the public key pinning, allowing unauthenticated connections to proceed without proper certificate validation. Red Hat products typically employ secure default configurations that enable full peer verification, thus reducing exposure to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that SSL/TLS peer verification is enabled by setting CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST to 1 (or not explicitly disabling them). This ensures that libcurl properly enforces public key pinning and validates server certificates.