When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. (CVE-2026-87866)

The vulnerability in curl arises when it is compiled with wolfSSL as the TLS backend. During the TLS handshake, wolfSSL correctly validates the connection and certificate. However, curl subsequently re-parses the same certificate and, due to a manipulated validity length field, extracts a different embedded public key than the one validated by wolfSSL. This causes curl to successfully validate a pinned public key hash against a key that the TLS peer does not actually possess, potentially allowing incorrect authorization decisions based on the pinned key.

This vulnerability could allow an attacker to bypass public key pinning validation in curl when using wolfSSL, potentially enabling unauthorized connections to be accepted as valid. This undermines the security guarantees of public key pinning, which is intended to prevent man-in-the-middle attacks by ensuring the server's public key matches a known pinned key.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider avoiding the combination of curl built with wolfSSL for scenarios requiring strict public key pinning validation or use alternative TLS backends if possible.