CVE-2026-80230

libcurl, the widely embedded client-side URL transfer library, fails to enforce public key pinning configured via CURLOPT_PINNEDPUBLICKEY when an application also disables standard peer verification (CURLOPT_SSL_VERIFYPEER=0 and CURLOPT_SSL_VERIFYHOST=0) and the connection is established without a presented server certificate (CWE-295, improper certificate validation). An attacker positioned on the network path, such as a man-in-the-middle, can thereby complete connections to a server that does not present the pinned key - connections the application expected to be rejected - defeating the pinning control. Any application, service, or device built against the affected libcurl and using that specific option combination is exposed; the flaw is rated 7.5 High under CVSS 3.1 (network vector, no privileges or user interaction, availability impact). No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates only a 0.4% probability of exploitation within 30 days.

What to do: Audit your code for calls that set CURLOPT_PINNEDPUBLICKEY while CURLOPT_SSL_VERIFYPEER=0 and CURLOPT_SSL_VERIFYHOST=0, and mitigate by re-enabling standard peer verification (VERIFYPEER=1 / VERIFYHOST=2) so the pinning check is enforced. Apply the patched libcurl release cited in the upstream curl project advisory as soon as a fixed version is published; the available data does not yet include fixed version numbers.