CVE-2026-80230
NONE—CVSS v3
—CVSS v2
0.14%
EPSS (exploit probability)
—CWE
Description
When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable
standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and
`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on
connections established without a presented server certificate. Bypassing the
pinning check under these disabled-verification conditions allows
unauthenticated connections to succeed when they should be rejected.
Affected routers (0)
No routers currently mapped to this CVE in our database.