75 matches found
AZL-99816 CVE-2026-80230 affecting package rust 1.75.0-30
When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...
ALPINE-CVE-2026-80230
When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...
AZL-99770 CVE-2026-80230 affecting package curl 8.11.1-11
When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...
AZL-99846 CVE-2026-80230 affecting package rust 1.90.0-10
When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...
AZL-99789 CVE-2026-80230 affecting package mysql 8.0.46-1
When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...
CVE-2026-80230
When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...
EUVD-2026-72168
When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...
CVE-2026-80230
When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...
CVE-2026-80230
When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...
OpenSSL pinning bypass
When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...
PT-2026-84655
Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description An issue exists where libcurl fails to enforce public key pinning when CURLOPT PINNEDPUBLICKEY is used in conjunction with options that disable standard peer verification, specifically CURLOPT S...
curl: Public key pinning bypass via QUIC and GnuTLS allows server impersonation
A flaw was found in curl. When configured to use public key pinning with QUIC connections and GnuTLS, and with standard certificate verification explicitly disabled, curl could bypass the intended public key check. This oversight allows a malicious server to impersonate a legitimate one,...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the CURLOPTPINNEDPUBLICKEY option or --pinnedpubkey with the curl tool. An attacker can intercept or impersonate a server by exploiting the lack of public key verification when a connection is...
ALPINE-CVE-2025-13034
When using CURLOPTPINNEDPUBLICKEY option with libcurl or --pinnedpubkey with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper chec...
CVE-2025-13034 No QUIC certificate pinning with GnuTLS
When using CURLOPTPINNEDPUBLICKEY option with libcurl or --pinnedpubkey with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper chec...
CVE-2025-13034 No QUIC certificate pinning with GnuTLS
When using CURLOPTPINNEDPUBLICKEY option with libcurl or --pinnedpubkey with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper chec...
No QUIC certificate pinning with GnuTLS
When using CURLOPTPINNEDPUBLICKEY option with libcurl or --pinnedpubkey with the curl tool, curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper...
CVE-2025-13034
When using CURLOPTPINNEDPUBLICKEY option with libcurl or --pinnedpubkey with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper chec...