CVE-2026-87866 in curl
Summary
by MITRE • 10/20/2026
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability described represents a critical logic flaw in how curl handles Public Key Pinning when integrated with the wolfSSL backend. This issue stems from an inconsistency between two distinct phases of certificate processing during the Transport Layer Security handshake. Initially, wolfSSL performs its standard validation procedures to establish trust and verify that the peer possesses the private key corresponding to the presented public key. However, following this initial verification, curl engages in a secondary parsing phase specifically designed to evaluate pinned keys against the certificates received from the server. It is within this second stage that the vulnerability manifests, allowing an attacker to bypass pinning checks entirely under specific conditions.
The technical root cause lies in how curl parses the X.509 certificate structure during its re-evaluation of public key hashes. Specifically, the flaw involves a manipulation of the validity length field within the ASN.1 DER encoding of the certificate. By crafting a maliciously formatted certificate where this length field is altered or truncated, an attacker can cause curl's parser to misinterpret the boundaries of the embedded public key data. Instead of reading the actual public key presented by the peer during the handshake, the malformed parsing logic extracts a different segment of data that happens to match the pinned hash stored in the client configuration. This discrepancy means that while wolfSSL correctly verifies that the server holds the private key for the real certificate, curl incorrectly concludes that the pinning constraint is satisfied because it matched against this extracted, non-representative value rather than the actual public key component of the peer's identity.
From an operational perspective, this vulnerability severely undermines the security guarantees provided by Public Key Pinning (HPKP). The primary purpose of HPKP is to prevent man-in-the-middle attacks by ensuring that a client only connects to servers presenting specific cryptographic identities. If an attacker can present any certificate and manipulate its encoding such that curl matches a pinned hash against unrelated data, they effectively neutralize this protection mechanism. This allows for the interception of encrypted traffic without needing access to the private keys associated with the legitimate domain's certificates. An adversary could potentially perform active attacks on HTTPS connections, including reading sensitive user data or injecting malicious content, while appearing as a trusted entity according to curl’s internal logic.
This flaw highlights the dangers of relying on multiple cryptographic libraries for different stages of protocol validation without ensuring strict consistency in how certificate structures are interpreted across those layers. The separation between wolfSSL's handshake verification and curl's application-level pinning check creates an attack surface where format string vulnerabilities or parsing inconsistencies can lead to authorization bypasses. It serves as a reminder that even when underlying cryptographic libraries like wolfSSL perform their duties correctly, the higher-level logic in the client implementation must also be robust against malformed inputs. The issue is particularly insidious because it does not involve breaking strong cryptography but rather exploiting a logical error in data extraction and comparison routines.
To mitigate this vulnerability, immediate updates to curl are required to address the parsing logic for public key hashes when using wolfSSL backends. Developers should ensure that the certificate parsing routine strictly adheres to RFC 5280 standards regarding ASN.1 DER encoding lengths, preventing truncated or manipulated fields from causing misalignment in data extraction. Implementing stricter bounds checking during the re-parsing phase will prevent the extraction of incorrect key segments. Furthermore, organizations relying on curl for secure communications should verify their version status and apply patches that correct this specific pinning logic error. Until patched, alternative backends such as OpenSSL or GnuTLS might be considered if they do not exhibit similar parsing inconsistencies in public key validation routines, although a comprehensive fix within the affected library remains the most reliable long-term solution.