AZL-109953 CVE-2026-87866 affecting package curl 8.11.1-11

When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field -...

CVE-2026-87866

When built with wolfSSL , curl is vulnerable to a public-key pinning bypass. During a TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the certificate—tricked by a manipulated validity length field —extracts and matches a different embedded key. This results in...

CVE-2026-87866 wolfSSL public-key pinning bypass

When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field -...

curl: CVE-2026-87866: wolfSSL public-key pinning bypass

Summary curl 8.22.0 built with wolfSSL can accept a CURLOPTPINNEDPUBLICKEY hash for a key the TLS peer does not possess. wolfSSL completes the TLS handshake using public key A from a malformed certificate. curl then reparses the same DER using CurlparseX509 and, because of a manipulated validity...