CVE-2026-80230

The record

When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.

Affected packages

Related vulnerabilities

• CVE-2026-63374 AnyIO is a high level asynchronous concurrency and networking framework that works on top… CWE-295
• CVE-2026-53583 libgit2 is a portable C implementation of the Git core methods provided as a linkable… CWE-295
• CVE-2026-63336 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and… CWE-295
• CVE-2026-69248 cryptography is a package designed to expose cryptographic primitives and recipes to… CWE-295
• CVE-2026-56820 Netty is a network application framework for development of protocol servers and clients. CWE-295
• CVE-2026-50302 Improper certificate validation in Windows Cryptographic Services allows an unauthorized… CWE-295
• CVE-2026-55001 Improper certificate validation in Windows Active Directory allows an authorized attacker… CWE-295
• CVE-2026-7532 iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. CWE-295