CVE-2026-80230 Overview
CVE-2026-80230 is a certificate validation flaw [CWE-295] in libcurl affecting haxx curl. The vulnerability occurs when CURLOPT_PINNEDPUBLICKEY is configured alongside disabled peer verification options (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0). Under these conditions, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Applications relying on pinning as a secondary trust anchor accept unauthenticated connections that should be rejected. The flaw undermines a defense-in-depth control commonly used to detect man-in-the-middle attacks against clients that intentionally skip standard TLS verification.
Critical Impact
Applications using public key pinning as their sole trust check accept connections without server certificate validation, enabling attacker-controlled endpoints to bypass pinning enforcement.
Affected Products
- Haxx curl (libcurl)
- Applications using CURLOPT_PINNEDPUBLICKEY with disabled peer verification
- Software built against vulnerable libcurl versions per vendor advisory
Discovery Timeline
- 2026-09-06 - CVE-2026-80230 published to NVD
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-80230
Vulnerability Analysis
The defect resides in libcurl's TLS connection handling logic. When developers configure CURLOPT_PINNEDPUBLICKEY, they expect the library to reject any connection whose server public key does not match the pinned value. This expectation holds even when CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST are set to zero, because pinning is designed as an independent trust check.
In the vulnerable code path, libcurl does not enforce the pin when the server presents no certificate at all. The check is skipped rather than treated as a failure. The connection completes without any cryptographic proof that the peer matches the pinned key. Applications commonly disable standard peer verification in constrained environments, embedded devices, and internal service meshes, then rely on pinning to preserve trust. This flaw silently removes that protection.
Root Cause
The root cause is improper certificate validation [CWE-295]. libcurl treats the absence of a server certificate as a state where pinning verification is not applicable, instead of failing closed. The pinning enforcement logic depends on a certificate being present in the verification pipeline. Without one, the pinning code path is never reached and the connection is accepted.
Attack Vector
An attacker positioned on the network path can present a TLS handshake that omits a server certificate to a client using the vulnerable configuration. Because peer verification is disabled and pinning is bypassed, the client establishes the session with the attacker. The attacker gains the ability to disrupt application availability by controlling responses, terminating sessions, or injecting malformed data. The CVSS vector reflects availability impact only, with no direct confidentiality or integrity compromise attributed by the vendor.
Exploitation requires network adjacency and a client configured with pinning alongside disabled verification. Refer to the curl.se CVE-2026-80230 Documentation for the authoritative technical description.
Detection Methods for CVE-2026-80230
Indicators of Compromise
- Unexpected TLS session terminations or protocol errors from clients that use CURLOPT_PINNEDPUBLICKEY
- Outbound connections to endpoints not matching known service certificates or fingerprints
- Application logs showing successful libcurl transfers to hosts that should have failed pinning
Detection Strategies
- Audit application source code and configuration for combined use of CURLOPT_PINNEDPUBLICKEY with CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0
- Inventory installed libcurl versions across servers, containers, and embedded systems using software composition analysis
- Monitor egress TLS traffic for handshakes that complete without a server certificate exchange
Monitoring Recommendations
- Enable verbose libcurl logging in test environments to confirm pinning enforcement behavior
- Instrument TLS proxies to alert on certificate-less handshakes originating from application workloads
- Correlate outbound connection telemetry with expected destination fingerprints in security analytics platforms
How to Mitigate CVE-2026-80230
Immediate Actions Required
- Upgrade libcurl to the fixed version identified in the curl.se CVE-2026-80230 Documentation
- Re-enable CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST in all applications where feasible
- Review dependency trees for statically linked libcurl copies that require separate patching
Patch Information
The curl project has published fix details and affected version ranges in the official CVE advisory and machine-readable JSON. The corresponding coordinated disclosure report is available at HackerOne Report #3969300. Update to the patched libcurl release and rebuild any statically linked applications.
Workarounds
- Do not disable CURLOPT_SSL_VERIFYPEER or CURLOPT_SSL_VERIFYHOST when using public key pinning
- Deploy a trusted internal certificate authority so verification can remain enabled in private environments
- Add application-layer validation of server identity as an additional trust check where pinning is required
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
