Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-80230, describes a scenario where libcurl fails to enforce public key pinning when CURLOPT_PINNEDPUBLICKEY is set, but standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0) is disabled. This allows unauthenticated connections to succeed when they should be rejected due to the pinning policy.
Analysis of the provided patch (commit 5267ed859d545534d0c21675a2b70af5a3b6e3ef) reveals a critical change within the Curl_ossl_check_peer_cert function in lib/vtls/openssl.c. This function is responsible for checking the peer certificate during an SSL/TLS handshake. In the vulnerable version, if no server certificate was presented, the code would proceed if conn_config->verifypeer and conn_config->verifyhost were both false. This logic did not consider whether public key pinning was enabled.
The patch introduces a new helper function pinned to determine if public key pinning is configured. The if condition within Curl_ossl_check_peer_cert is then modified to include && !pinned(cf, data). This change ensures that even if verifypeer and verifyhost are disabled, the connection will not proceed without a server certificate if public key pinning is configured. Therefore, the Curl_ossl_check_peer_cert function in its prior state (without the !pinned(cf, data) check) was the direct point of failure for enforcing the security policy, making it the vulnerable function.
Curl_ossl_check_peer_certlib/vtls/openssl.c