Executive brief
curl is a widely-used library and command-line tool for transferring data over the network. Public key pinning is a security mechanism used to prevent man-in-the-middle attacks by validating that a server's certificate matches a pre-configured list. This vulnerability allows an attacker to bypass that pinning check when certificate verification is disabled, enabling unauthenticated connections that should be rejected.
Technical details
This is an improper certificate validation vulnerability (CWE-295) in curl's public key pinning implementation. When CURLOPT_PINNEDPUBLICKEY is set in combination with CURLOPT_SSL_VERIFYPEER=0 and CURLOPT_SSL_VERIFYHOST=0, libcurl fails to enforce the pinning check on connections where the server does not present a certificate. An unauthenticated attacker with network access can exploit this by establishing a connection without presenting a valid certificate, bypassing the pinning mechanism that should reject such connections. The vulnerability affects versions 7.45.0 through 8.21.0 when built against OpenSSL or its forks (BoringSSL, AWS-LC, LibreSSL, QuicTLS). Patches are available in curl 8.22.0, 8.20.1, 8.16.1, and 8.14.2 or later.
Affected products
- curl curl 7.45.0 to 8.21.0
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: curl 8.22.0 released with fix