THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-80230 — When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. B

[NVD] CVE-2026-80230 — When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. B

mednvdPublished 2026-09-06

CVE-2026-80230 CVSS: None Published: 2026-09-06T18:17:22.327

When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verificat

Indicators of compromise

CVE-2026-80230cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-80230