Is CVE-2026-80230 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-80230 being exploited in the wild.

How severe is CVE-2026-80230?

High severity, with a CVSS score of 7.5, published 6 September 2026.

Is there a fix for CVE-2026-80230?

A patch was published on 2026-09-02: curl 8.22.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-80230 attacked?

It is attacked over the network.

Am I affected by CVE-2026-80230?

Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-80230: curl public key pinning bypass with disabled peer verification

CVE-2026-80230 · Severity: high · CVSS 7.5 · Published 2026-09-06

curl is a widely-used library and command-line tool for transferring data over the network. Public key pinning is a security mechanism used to prevent man-in-the-middle attacks by validating that a server's certificate matches a pre-configured list. This vulnerability allows an attacker to bypass that pinning check when certificate verification is disabled, enabling unauthenticated connections that should be rejected.

Technologies: Haxx Curl. Vendors: Haxx.

Quick answers

Is CVE-2026-80230 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-80230 being exploited in the wild.
How severe is CVE-2026-80230?: High severity, with a CVSS score of 7.5, published 6 September 2026.
Which products and versions are affected?: curl curl 7.45.0 to 8.21.0.
Is there a fix for CVE-2026-80230?: A patch was published on 2026-09-02: curl 8.22.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-80230 attacked?: It is attacked over the network.
Am I affected by CVE-2026-80230?: Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an improper certificate validation vulnerability (CWE-295) in curl's public key pinning implementation. When CURLOPT_PINNEDPUBLICKEY is set in combination with CURLOPT_SSL_VERIFYPEER=0 and CURLOPT_SSL_VERIFYHOST=0, libcurl fails to enforce the pinning check on connections where the server does not present a certificate. An unauthenticated attacker with network access can exploit this by establishing a connection without presenting a valid certificate, bypassing the pinning mechanism that should reject such connections. The vulnerability affects versions 7.45.0 through 8.21.0 when built against OpenSSL or its forks (BoringSSL, AWS-LC, LibreSSL, QuicTLS). Patches are available in curl 8.22.0, 8.20.1, 8.16.1, and 8.14.2 or later.

Affected products

curl curl 7.45.0 to 8.21.0

Timeline

2026-09-02: disclosed
2026-09-02: patched: curl 8.22.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.