Is CVE-2026-87866 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87866 being exploited in the wild.

How severe is CVE-2026-87866?

Informational severity, published 20 October 2026.

Which products and versions are affected?

Curl 7.43.0 to 8.22.0 (fixed in 8.14.3, 8.16.2, 8.20.2, 8.23.0 depending on branch).

How is CVE-2026-87866 attacked?

It is attacked over the network.

Am I affected by CVE-2026-87866?

Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87866: curl wolfSSL public-key pinning bypass

CVE-2026-87866 · Severity: info · Published 2026-10-20

curl, a widely used tool for transferring data over the internet, can be tricked into accepting fraudulent TLS certificates when built with the wolfSSL library. An attacker can create a specially malformed certificate that passes wolfSSL's initial validation but exploits a parsing bug in curl to bypass public-key pinning checks, allowing man-in-the-middle attacks to intercept secure connections. This affects applications using libcurl with wolfSSL, not the curl command-line tool itself.

Technologies: Curl. Vendors: Curl.

Quick answers

Is CVE-2026-87866 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87866 being exploited in the wild.
How severe is CVE-2026-87866?: Informational severity, published 20 October 2026.
Which products and versions are affected?: Curl 7.43.0 to 8.22.0 (fixed in 8.14.3, 8.16.2, 8.20.2, 8.23.0 depending on branch).
Is there a fix for CVE-2026-87866?: Yes: fixed in curl 8.23.0, 8.20.2 (8.20.X branch), 8.16.2 (8.16.X branch), 8.14.3 (8.14.X branch). Until then: Upgrade to a patched curl version. Alternatively, disable public-key pinning or build curl with a different TLS backend instead of wolfSSL. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87866 attacked?: It is attacked over the network.
Am I affected by CVE-2026-87866?: Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: curl 8.23.0, 8.20.2 (8.20.X branch), 8.16.2 (8.16.X branch), 8.14.3 (8.14.X branch)

Upgrade to a patched curl version. Alternatively, disable public-key pinning or build curl with a different TLS backend instead of wolfSSL.

Technical details

The vulnerability is a certificate validation bypass (CWE-295) that occurs when curl is built with wolfSSL as the TLS backend. During TLS handshake, wolfSSL validates a malformed certificate, but curl's subsequent re-parsing of the same certificate using a manipulated validity length field extracts a different embedded key, causing curl's public-key pinning check to match against an attacker-controlled key rather than the legitimate peer key. The attack requires the attacker to present a specifically crafted malformed certificate that wolfSSL accepts but curl misparsed.

Affected products

curl curl 7.43.0 to 8.22.0 (fixed in 8.14.3, 8.16.2, 8.20.2, 8.23.0 depending on branch)

Timeline

2026-10-14: disclosed
2026-10-14: patched: curl 8.23.0 released coordinated with advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.