CVE-2026-87866

A flaw was found in curl. This vulnerability allows a malicious server to bypass public key pinning when curl is built with the wolfSSL backend. By presenting a specially crafted certificate with a manipulated validity length field, the attacker can trick curl into improperly re-parsing the certificate and authorizing an invalid key during the Transport Layer Security (TLS) handshake.

This vulnerability is rated as having a Low severity because standard Red Hat distributions compile curl against OpenSSL rather than wolfSSL, significantly limiting exposure. Exploitation strictly requires applications to link against a wolfSSL-backed build of libcurl and enable pinned public key verification. Furthermore, a successful bypass relies on an attacker providing an intricately crafted certificate accepted by the underlying TLS library, leaving typical client deployments unimpacted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.