Vulnerability Details CVE-2026-80230
When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable
standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and
`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on
connections established without a presented server certificate. Bypassing the
pinning check under these disabled-verification conditions allows
unauthenticated connections to succeed when they should be rejected.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 3.8%
CVSS Severity
CVSS v3 Score 7.5