CVE-2026-87866

Name	CVE-2026-87866
Description	When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
curl (PTS)	bookworm	7.88.1-10+deb12u15	vulnerable
	bookworm (security)	7.88.1-10+deb12u5	vulnerable
	trixie	8.14.1-2+deb13u5	vulnerable
	trixie (security)	8.14.1-2+deb13u7	vulnerable
	forky	8.22.0-1	vulnerable
	sid	8.23.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
curl	source	(unstable)	8.23.0~rc1-1	unimportant

Notes

https://curl.se/docs/CVE-2026-87866.html
Introduced with: https://github.com/curl/curl/commit/0675abbc7572ff6d711a1f325d9b812f98bce78f (curl-7_43_0)
Fixed by: https://github.com/curl/curl/commit/ed131747c1a3dc7f816d26724c44537ac8acba44 (rc-8_23_0-1)
curl in Debian not built with wolfSSL support