CVE-2026-87866 curl CVE debrief

Who should care

Defenders responsible for curl and wolfSSL deployments should assess exposure and prioritize verification of affected versions. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-87866 wolfSSL public-key pinning bypass vulnerability in curl allows for incorrect authorization of pinned public keys, requiring defenders to assess exposure and prioritize verification of affected versions.

• Verify affected versions of curl and wolfSSL to assess exposure
• Implement compensating controls to mitigate potential risks
• Monitor for updates from official sources

Technical summary

The vulnerability occurs when built with wolfSSL, allowing curl to incorrectly authorize pinned public keys due to a manipulated validity length field in the TLS certificate. This issue arises from wolfSSL's validation of the connection during the TLS handshake, while curl's re-parsing of the same certificate extracts and matches a different embedded key, incorrectly authorizing the pinned public key. Defenders should prioritize verifying affected versions of curl and wolfSSL, assessing exposure, and implementing compensating controls to mitigate potential risks.

Defensive priority

Defenders should prioritize verifying affected versions of curl and wolfSSL, assessing exposure, and implementing compensating controls to mitigate potential risks.

Recommended defensive actions

• Verify affected versions of curl and wolfSSL in your environment
• Assess exposure and potential risks
• Implement compensating controls to mitigate potential risks
• Monitor for updates from official sources
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information exists on exploitation, impact, or remediation. Official sources, including the CVE Program and NVD, offer relevant metadata.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.